GHSA-x3vm-88hf-gpxp

Suggest an improvement
Source
https://github.com/advisories/GHSA-x3vm-88hf-gpxp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-x3vm-88hf-gpxp/GHSA-x3vm-88hf-gpxp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-x3vm-88hf-gpxp
Aliases
Published
2025-07-15T15:18:06Z
Modified
2025-07-15T16:27:18Z
Severity
  • 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged
Details

Summary

When using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template string.

Impact

Malicious admins can log sensitive data from other users when they are created or updated.

Workarounds

Avoid logging sensitive data to the console outside the context of development.

Database specific 
{
    "cwe_ids": [
        "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-15T15:18:06Z",
    "nvd_published_at": "2025-07-15T00:15:23Z",
    "severity": "MODERATE"
}
References

Affected packages

npm / directus

Package

Name
directus
View open source insights on deps.dev
Purl
pkg:npm/directus

Affected ranges

Type
SEMVER
Events
Introduced
9.0.0
Fixed
11.9.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-x3vm-88hf-gpxp/GHSA-x3vm-88hf-gpxp.json"