{"action":"Upgrade directus to 10.11.2 or later.","affected":[{"fixed":"10.11.2","introduced":"0"}],"component":"directus","cve_ids":["CVE-2024-36128"],"ecosystem":"npm","epss":0.0062,"exploited":false,"fixed_versions":["10.11.2"],"ghsa_id":"GHSA-632p-p495-25m5","id":"tcs_01M5KF58MPT144Z3MJ9CJHB5A0","modified_at":"2026-09-10T03:50:14.883193936Z","published_at":"2024-06-04T17:53:29Z","references":["https://osv.dev/vulnerability/GHSA-632p-p495-25m5","https://github.com/directus/directus/security/advisories/GHSA-632p-p495-25m5","https://nvd.nist.gov/vuln/detail/CVE-2024-36128","https://github.com/directus/directus/commit/7d2a1392f43613094de700062aba168a9400dd3b","https://github.com/directus/directus"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-632p-p495-25m5","url":"https://osv.dev/vulnerability/GHSA-632p-p495-25m5"}],"summary":"Directus is soft-locked by providing a string value to random string util"}