{"schema_version":"1.7.3","id":"GO-2024-3306","published":"2024-12-12T22:00:01Z","modified":"2026-08-07T08:12:28.318270605Z","aliases":["CVE-2024-53257","GHSA-7mwh-q3xm-qh6p"],"summary":"Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess","details":"Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess","affected":[{"package":{"name":"vitess.io/vitess","ecosystem":"Go","purl":"pkg:golang/vitess.io/vitess"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.19.8"},{"introduced":"0.20.0"},{"fixed":"0.20.4"},{"introduced":"0.21.0"},{"fixed":"0.21.1"}]}],"ecosystem_specific":{"custom_ranges":[{"events":[{"introduced":"0"},{"fixed":"19.0.8"},{"introduced":"20.0.0"},{"fixed":"20.0.4"},{"introduced":"21.0.0"},{"fixed":"21.0.1"}],"type":"ECOSYSTEM"}],"imports":[{"path":"vitess.io/vitess/go/vt/vtgate"},{"path":"vitess.io/vitess/go/vt/vttablet/tabletserver"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2024-3306.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/vitessio/vitess/security/advisories/GHSA-7mwh-q3xm-qh6p"},{"type":"FIX","url":"https://github.com/vitessio/vitess/commit/2b71d1b5f8ca676beeab2875525003cd45096217"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2024-3306"}}