{"action":"Upgrade vitess.io/vitess to 0.19.8 or later.","affected":[{"fixed":"0.21.1","introduced":"0.21.0-rc1"},{"fixed":"0.20.4","introduced":"0.20.0-rc1"},{"fixed":"0.19.8","introduced":"0"}],"component":"vitess.io/vitess","cve_ids":["CVE-2024-53257"],"ecosystem":"Go","epss":0.00439,"exploited":false,"fixed_versions":["0.21.1","0.20.4","0.19.8"],"ghsa_id":"GHSA-7mwh-q3xm-qh6p","id":"tcs_01M5KF2C3X48N7CYZACPY2RJHF","modified_at":"2026-08-07T08:12:23.040509879Z","published_at":"2024-12-03T18:43:33Z","references":["https://osv.dev/vulnerability/GHSA-7mwh-q3xm-qh6p","https://github.com/vitessio/vitess/security/advisories/GHSA-7mwh-q3xm-qh6p","https://nvd.nist.gov/vuln/detail/CVE-2024-53257","https://github.com/vitessio/vitess/commit/2b71d1b5f8ca676beeab2875525003cd45096217","https://github.com/vitessio/vitess"],"severity":{"label":"medium","score":4.9},"sources":[{"source":"osv","source_id":"GHSA-7mwh-q3xm-qh6p","url":"https://osv.dev/vulnerability/GHSA-7mwh-q3xm-qh6p"}],"summary":"Vitess allows HTML injection in /debug/querylogz & /debug/env"}