AIKIDO-2026-836673

TL;DR

The app builds a fallback favicon by interpolating the configured project color into an SVG markup string and assigning the result to innerHTML without escaping or validating the value as a color. A principal permitted to update project settings can persist a crafted color that breaks out of the SVG context and injects arbitrary HTML. Because the color is served through a public server-info endpoint and the favicon is computed by the app's root component, the injected script executes for every visitor who loads the Directus URL, including administrators. The fix assembles the favicon with SVG DOM APIs and sets the color as an attribute value.