{"action":"Upgrade github.com/zitadel/zitadel to 0.0.0-20240311065202-07ec2efa9dc6 or later.","affected":[{"fixed":"2.41.15","introduced":"1.80.1"},{"fixed":"2.42.15","introduced":"2.42.0"},{"fixed":"2.43.9","introduced":"2.43.0"},{"fixed":"2.44.3","introduced":"2.44.0"},{"fixed":"2.45.1","introduced":"2.45.0"},{"fixed":"2.46.1","introduced":"2.46.0"},{"fixed":"2.47.4","introduced":"2.47.0"},{"introduced":"0"},{"fixed":"1.80.0-v2.20.0.20240311065202-07ec2efa9dc6","introduced":"0.0.0"}],"component":"github.com/zitadel/zitadel","cve_ids":["CVE-2024-28855"],"ecosystem":"Go","epss":0.00779,"exploited":false,"fixed_versions":["2.41.15","2.42.15","2.43.9","2.44.3","2.45.1","2.46.1","2.47.4","0.0.0-20240311065202-07ec2efa9dc6","1.80.0-v2.20.0.20240311065202-07ec2efa9dc6"],"ghsa_id":"GHSA-hfrg-4jwr-jfpj","id":"tcs_01M5KFCFQJCKTKRP5KZ3CXXCWV","modified_at":"2026-09-10T03:50:10.567094211Z","published_at":"2024-03-18T20:34:00Z","references":["https://osv.dev/vulnerability/GHSA-hfrg-4jwr-jfpj","https://github.com/zitadel/zitadel/security/advisories/GHSA-hfrg-4jwr-jfpj","https://nvd.nist.gov/vuln/detail/CVE-2024-28855","https://github.com/zitadel/zitadel/commit/07ec2efa9dc62f7a6c3a58c112b2879d24bc3e3c","https://github.com/zitadel/zitadel","https://github.com/zitadel/zitadel/releases/tag/v2.41.15","https://github.com/zitadel/zitadel/releases/tag/v2.42.15","https://github.com/zitadel/zitadel/releases/tag/v2.43.9","https://github.com/zitadel/zitadel/releases/tag/v2.44.3","https://github.com/zitadel/zitadel/releases/tag/v2.45.1","https://github.com/zitadel/zitadel/releases/tag/v2.46.1","https://github.com/zitadel/zitadel/releases/tag/v2.47.3"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-hfrg-4jwr-jfpj","url":"https://osv.dev/vulnerability/GHSA-hfrg-4jwr-jfpj"}],"summary":"Improper HTML sanitization in ZITADEL"}