-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper encoding in the URL query parameter construction shown in the provided issue (#17119) and fixed in PR #17120. The original code in url.ts lines 69-73 directly concatenated query parameters without using encodeURIComponent, allowing attackers to inject arbitrary HTML via unescaped special characters in reset_url parameters. The fix added proper encoding using encodeURIComponent for both keys and values, confirming this was the vulnerable code path.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| directus | npm | < 9.23.0 | 9.23.0 |