Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-n7m6-zecb-6qh2
Vulnerability ID VCID-n7m6-zecb-6qh2
Aliases CVE-2023-45820
GHSA-hmgw-9jrg-hf2m
Summary Directus crashes on invalid WebSocket message Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has been addressed in version 10.6.2. Users are advised to upgrade. Users unable to upgrade should avoid using websockets.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-755 Improper Handling of Exceptional Conditions
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2023-45820
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-hmgw-9jrg-hf2m
cvssv3.1 7.5 https://github.com/directus/directus
generic_textual HIGH https://github.com/directus/directus
cvssv3.1 5.9 https://github.com/directus/directus/commit/243eed781b42d6b4948ddb8c3792bcf5b44f55bb
cvssv3.1 7.5 https://github.com/directus/directus/commit/243eed781b42d6b4948ddb8c3792bcf5b44f55bb
generic_textual HIGH https://github.com/directus/directus/commit/243eed781b42d6b4948ddb8c3792bcf5b44f55bb
ssvc Track https://github.com/directus/directus/commit/243eed781b42d6b4948ddb8c3792bcf5b44f55bb
cvssv3.1 7.5 https://github.com/directus/directus/releases/tag/v10.6.2
generic_textual HIGH https://github.com/directus/directus/releases/tag/v10.6.2
cvssv3.1 5.9 https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m
cvssv3.1 7.5 https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m
cvssv3.1_qr HIGH https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m
generic_textual HIGH https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m
ssvc Track https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-45820
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-45820
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-45820
https://github.com/directus/directus
https://github.com/directus/directus/commit/243eed781b42d6b4948ddb8c3792bcf5b44f55bb
https://github.com/directus/directus/releases/tag/v10.6.2
CVE-2023-45820 https://nvd.nist.gov/vuln/detail/CVE-2023-45820
GHSA-hmgw-9jrg-hf2m https://github.com/advisories/GHSA-hmgw-9jrg-hf2m
GHSA-hmgw-9jrg-hf2m https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/directus/directus
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/directus/directus/commit/243eed781b42d6b4948ddb8c3792bcf5b44f55bb
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/directus/directus/commit/243eed781b42d6b4948ddb8c3792bcf5b44f55bb
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-12T17:37:55Z/ Found at https://github.com/directus/directus/commit/243eed781b42d6b4948ddb8c3792bcf5b44f55bb
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/directus/directus/releases/tag/v10.6.2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-12T17:37:55Z/ Found at https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-45820
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.58452
EPSS Score 0.0036
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:02:20.668123+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/directus/CVE-2023-45820.yml 38.6.0