{"action":"Upgrade github.com/zitadel/zitadel to 0.0.0-20240731122110-189505c80fa6 or later.","affected":[{"fixed":"2.52.3","introduced":"1.80.1"},{"fixed":"2.53.9","introduced":"2.53.0"},{"fixed":"2.54.8","introduced":"2.54.0"},{"fixed":"2.55.5","introduced":"2.55.0"},{"fixed":"2.56.2","introduced":"2.56.0"},{"fixed":"2.57.1","introduced":"2.57.0"},{"fixed":"2.58.1","introduced":"2.58.0"},{"introduced":"0"},{"fixed":"1.80.0-v2.20.0.20240731122110-189505c80fa6","introduced":"0.0.0"}],"component":"github.com/zitadel/zitadel","cve_ids":["CVE-2024-41953"],"ecosystem":"Go","epss":0.0065,"exploited":false,"fixed_versions":["2.52.3","2.53.9","2.54.8","2.55.5","2.56.2","2.57.1","2.58.1","0.0.0-20240731122110-189505c80fa6","1.80.0-v2.20.0.20240731122110-189505c80fa6"],"ghsa_id":"GHSA-v333-7h2p-5fhv","id":"tcs_01M5KFNFAASR9SZA47F6PSMEXR","modified_at":"2025-07-09T15:00:31Z","published_at":"2024-07-31T20:59:13Z","references":["https://osv.dev/vulnerability/GHSA-v333-7h2p-5fhv","https://github.com/zitadel/zitadel/security/advisories/GHSA-v333-7h2p-5fhv","https://nvd.nist.gov/vuln/detail/CVE-2024-41953","https://github.com/zitadel/zitadel/commit/0e1f99e987b5851caec45a72660fe9f67e425747","https://github.com/zitadel/zitadel/commit/38da602ee1cfc35c0d7918c298fbfc3f3674133b","https://github.com/zitadel/zitadel/commit/4b59cac67bb89c1f3f84a2041dd273d11151d29f","https://github.com/zitadel/zitadel/commit/c1a3fc72dde16e987d8a09aa291e7c2edfc928f7","https://github.com/zitadel/zitadel/commit/c353f82f89c6982c0888c6763363296cf4263cb2","https://github.com/zitadel/zitadel/commit/d04ac6df8f2f0243e649b802a8bfa6176cef0923","https://github.com/zitadel/zitadel/commit/f846616a3f022e88e3ea8cea05d3254ad86f1615","https://pkg.go.dev/vuln/GO-2024-3015","https://github.com/zitadel/zitadel/releases/tag/v2.58.1","https://github.com/zitadel/zitadel/releases/tag/v2.57.1","https://github.com/zitadel/zitadel/releases/tag/v2.56.2","https://github.com/zitadel/zitadel/releases/tag/v2.55.5","https://github.com/zitadel/zitadel/releases/tag/v2.54.8","https://github.com/zitadel/zitadel/releases/tag/v2.53.9","https://github.com/zitadel/zitadel/releases/tag/v2.52.3","https://github.com/zitadel/zitadel"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-v333-7h2p-5fhv","url":"https://osv.dev/vulnerability/GHSA-v333-7h2p-5fhv"}],"summary":"ZITADEL has improper HTML sanitization in emails and Console UI"}