{"schema_version":"1.3.1","id":"GO-2024-3306","modified":"2024-12-12T22:00:01Z","published":"2024-12-12T22:00:01Z","aliases":["CVE-2024-53257","GHSA-7mwh-q3xm-qh6p"],"summary":"Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess","details":"Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess","affected":[{"package":{"name":"vitess.io/vitess","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.19.8"},{"introduced":"0.20.0"},{"fixed":"0.20.4"},{"introduced":"0.21.0"},{"fixed":"0.21.1"}]}],"ecosystem_specific":{"imports":[{"path":"vitess.io/vitess/go/vt/vtgate"},{"path":"vitess.io/vitess/go/vt/vttablet/tabletserver"}],"custom_ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.0.8"},{"introduced":"20.0.0"},{"fixed":"20.0.4"},{"introduced":"21.0.0"},{"fixed":"21.0.1"}]}]}}],"references":[{"type":"ADVISORY","url":"https://github.com/vitessio/vitess/security/advisories/GHSA-7mwh-q3xm-qh6p"},{"type":"FIX","url":"https://github.com/vitessio/vitess/commit/2b71d1b5f8ca676beeab2875525003cd45096217"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2024-3306","review_status":"REVIEWED"}}