GO-2024-3306
Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess
At a glance
- Published
- Updated
- CVE
- CVE-2024-53257
- Aliases
- GHSA-7mwh-q3xm-qh6p
Description
Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess
Affected packages
| Package | Versions |
|---|---|
| Go · vitess.io/vitess | introduced 0, fixed 0.19.8, introduced 0.20.0, fixed 0.20.4, introduced 0.21.0, fixed 0.21.1 |
References
- https://github.com/vitessio/vitess/security/advisories/GHSA-7mwh-q3xm-qh6p ADVISORY
- https://github.com/vitessio/vitess/commit/2b71d1b5f8ca676beeab2875525003cd45096217 FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |