directus

Directus is a real-time API and App dashboard for managing SQL database content

Latest 12.5.0

NPM

86%

Total Score

healthy

Active releases and broad project activity outweigh workflow pinning and audit concerns.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 18 workflows were analyzed, with no untrusted checkout or script-injection findings, but all 63 action references are unpinned. The audit also found high-severity, low-confidence cache-poisoning and high-confidence ad hoc package installation, while several workflows use top-level write permissions.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-410222 directus is vulnerable to SQL Injection in versions 0.0.1 - 12.0.2.	0.0.1 - 12.0.2	High
AIKIDO-2026-313039 directus is vulnerable to Path Traversal in versions 10.13.0 - 12.0.2.	10.13.0 - 12.0.2	High
AIKIDO-2026-843606 directus is vulnerable to Missing Authorization in versions 11.13.0 - 12.0.2.	11.13.0 - 12.0.2	Medium
AIKIDO-2026-545434 directus is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 12.0.2.	0.0.1 - 12.0.2	High
AIKIDO-2026-593378 directus is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) in versions 10.10.5 - 12.0.2.	10.10.5 - 12.0.2	High