Threats tagged 'ghsa-r6wx-627v-gh2f'

Directus app versions 10.10.0 to before 10.13.4, 11.0.0-rc.1 to before 11.2.2, and 11.0.0 to before 13.3.1 contain an HTML Injection vulnerability in the Comment feature. The client-side filter intended to block HTML tags can be bypassed by sending crafted requests directly to the comment endpoint, allowing injection of arbitrary HTML. This can lead to malicious scripts executing with the privileges of the authenticated user, potentially enabling unauthorized actions.