@directus/api (31.0.0), directus (11.12.0) potentially affected by CVE-2025-64747 via @directus/app (14.0.0)

@directus/app NPM version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/app and may be impacted: - @directus/api 31.0.0 - directus 11.12.0 Source cves: CVE-2025-64747 Source advisory: SNYK:JS-DIRECTUSAPP-13985180...

Cross-site Scripting (XSS)

Overview @directus/app is an App dashboard for Directus Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Block Editor interface when users with upload files and edit item permissions inject malicious JavaScript. An attacker can execute arbitrary scripts in the...

@directus/api (>=20.0.0-rc.0, <=23.1.0), directus (>=11.0.0-rc.1, <=11.1.2) potentially affected by CVE-2025-24353 via @directus/app (>=13.0.0, <=13.3.0)

@directus/app NPM version =13.0.0, =20.0.0-rc.0, =11.0.0-rc.1, =11.1.2 Source cves: CVE-2025-24353 Source advisory: OSV:GHSA-PMF4-V838-29HG...