GHSA-9qrm-48qf-r2rw: Directus has a DOM-Based cross-site scripting (XSS) via layout_options
Directus allows an authenticated attacker to save cross site scripting code to the database. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.
References
Detect and mitigate GHSA-9qrm-48qf-r2rw with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →