-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| directus | npm | < 11.13.0 | 11.13.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a stored XSS in the Block Editor of Directus. The root cause is the lack of input sanitization when processing content from the block editor. The patch d23525317f0780f04aa1fe7a99171a358e43cb2e addresses this by introducing proper sanitization.
The analysis of the patch reveals that the original sanitizeValue function in app/src/interfaces/input-block-editor/input-block-editor.vue was flawed. It merely cloned the input data without performing any security checks, allowing malicious content to be persisted. This function is identified as the primary vulnerable function.
The patch replaces this insecure function with a new implementation in app/src/interfaces/input-block-editor/sanitize.ts. The new sanitizeBlockData function uses the dompurify library to effectively sanitize the content, thus mitigating the XSS risk. This function is also included as it is a key runtime indicator of the patched and secure version.
A Semantic Attack on Google Gemini - Read the Latest Research