Vulnerabilities

Security incident · GHSA-788p-cvgf-q973

Stored cross-site scripting via unsanitized project color in the generated favicon

Published Aug 5, 2026 · catalog updated Aug 5, 2026 · Stored cross-site scripting via

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-788p-cvgf-q973. A missing EPSS score is not a low risk. Compare Stored cross-site scripting via with the linked advisory before you change production.

Severity

Medium5.4

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

npm directus

## Description ### Summary The Directus app builds a fallback favicon from the configured project color by interpolating that color into an SVG markup string and assigning the result to . Because the value is never escaped or validated as a color, a crafted project color breaks out of the SVG context and injects arbitrary HTML, which executes script in the origin of the Directus application when a browser loads the app. ### Details ( ) accepted the project color as a string, embedded it in an SVG declaration, and parsed the resulting markup by assigning it to the of a . No HTML or CSS escaping was applied at any point on that path. The value passed in is from the singleton, surfaced to the app through the endpoint. Any principal permitted to update can therefore persist an arbitrary string into this sink. In the default configuration that is the administrator role; the exposure that matters is a non-admin policy that has been granted update access to , which turns settings write access into script execution in an administrator's session. Two properties broaden the reach of the payload: - The element the markup is parsed into is never attached to the document, but that does not prevent execution. Markup parsed via on a detached element still triggers resource loading and the associated event handlers, so injected content runs immediately. - is a public endpoint and the favicon is computed by the app's root component, so the payload fires for every visitor who loads the Directus URL, including unauthenticated visitors on the login page, before any user-specific gating. ### Impact Stored cross-site scripting in the Directus application. A user with permission to write project settings can persist a payload that executes for every subsequent visitor to the Directus URL, including administrators, enabling session or token theft and API actions performed with the victim's privileges. Where settings write access has been delegated to a non-administrative policy, this const