medium4.2
CVE-2025-53885
Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged
Impact
### Summary When using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template string. ### Impact Malicious admins can log sensitive data from other users when they are created or updated. ### Workarounds Avoid logging sensitive data to the console outside the context of development.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | directus | >= 9.0.0, < 11.9.0 | 11.9.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Monospace | Directus | from 9.0.0 before 11.9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/directus/directus/commit/859f664f56fb50401c407b095889cea38ff580e5
- https://github.com/directus/directus/pull/25355
- https://github.com/directus/directus/releases/tag/v11.9.0
- https://github.com/directus/directus/security/advisories/GHSA-x3vm-88hf-gpxp
- https://github.com/advisories/GHSA-x3vm-88hf-gpxp
- https://nvd.nist.gov/vuln/detail/CVE-2025-53885