CVE-2024-6533: Directus has a DOM-Based cross-site scripting (XSS) via layout_options

January 23, 2025 (updated August 14, 2026)

Directus allows an authenticated attacker to save cross site scripting code to the database. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.

References

github.com/advisories/GHSA-9qrm-48qf-r2rw
github.com/directus/directus/security/advisories/GHSA-9qrm-48qf-r2rw
nvd.nist.gov/vuln/detail/CVE-2024-6533

Code Behaviors & Features

Detect and mitigate CVE-2024-6533 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →