directus vulnerable to HTML Injection in Password Reset email to custom Reset URL

GHSA-4hmq-ggrm-qfc6 · CVE-2023-27474

Published Mar 7, 2023 · Modified Sep 10, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL.

Patches

The problem has been resolved and released under version 9.23.0. People relying on a custom password reset URL should upgrade to 9.23.0 or later, or remove the custom reset url from the configured allow list.

Workarounds

Disable the custom reset URL allow list.

References

WEB https://github.com/directus/directus/security/advisories/GHSA-4hmq-ggrm-qfc6
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-27474
WEB https://github.com/directus/directus/issues/17119
WEB https://github.com/directus/directus/pull/17120
PACKAGE https://github.com/directus/directus

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes