{"action":"Upgrade vitess.io/vitess to 0.19.8 or later.","affected":[{"fixed":"0.19.8","introduced":"0"},{"fixed":"0.20.4","introduced":"0.20.0"},{"fixed":"0.21.1","introduced":"0.21.0"}],"component":"vitess.io/vitess","cve_ids":["CVE-2024-53257"],"ecosystem":"Go","epss":0.00439,"exploited":false,"fixed_versions":["0.19.8","0.20.4","0.21.1"],"ghsa_id":"GHSA-7mwh-q3xm-qh6p","id":"tcs_01M5KG674V513B9ZGNR09MRNE0","modified_at":"2026-08-07T08:12:28.318270605Z","published_at":"2024-12-12T22:00:01Z","references":["https://osv.dev/vulnerability/GO-2024-3306","https://github.com/vitessio/vitess/security/advisories/GHSA-7mwh-q3xm-qh6p","https://github.com/vitessio/vitess/commit/2b71d1b5f8ca676beeab2875525003cd45096217"],"severity":{"label":"medium","score":4.9},"sources":[{"source":"osv","source_id":"GO-2024-3306","url":"https://osv.dev/vulnerability/GO-2024-3306"},{"source":"nvd","source_id":"CVE-2024-53257","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53257"}],"summary":"Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess"}