{"id":"CVE-2024-53257","aliases":["GHSA-7mwh-q3xm-qh6p","GO-2024-3306"],"title":"Vitess allows HTML injection in /debug/querylogz & /debug/env","summary":"Vitess allows HTML injection in /debug/querylogz & /debug/env","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","vendor":"vitess","product":"vitess.io/vitess","ecosystem":"go","affected":["vitess.io/vitess >= 0.21.0-rc1, < 0.21.1","vitess.io/vitess >= 0.20.0-rc1, < 0.20.4","vitess.io/vitess < 0.19.8"],"patched":["vitess.io/vitess 0.21.1","vitess.io/vitess 0.20.4","vitess.io/vitess 0.19.8"],"published":"2024-12-03","updated":"2026-08-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-7mwh-q3xm-qh6p","references":[{"url":"https://github.com/vitessio/vitess/security/advisories/GHSA-7mwh-q3xm-qh6p"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53257"},{"url":"https://github.com/vitessio/vitess/commit/2b71d1b5f8ca676beeab2875525003cd45096217"},{"url":"https://github.com/vitessio/vitess"}],"tags":["osv","go"],"epss":0.00439,"epssPercentile":0.37628,"ingestedAt":"2026-08-07T19:14:16.171Z","slug":"CVE-2024-53257","body":"## Overview\n\n### Summary\n\nThe `/debug/querylogz` and `/debug/env` pages for `vtgate` and `vttablet` do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will.\n\n### Details\n\nThese pages are rendered using `text/template` instead of rendering with a proper HTML templating engine.\n\n### PoC\n\nExecute any query where part of it is HTML markup, for example as part of a string. To make it easier to observe you might want to make sure the query takes a few seconds to complete, giving you time to refresh the status page. \n\nExample query that can trigger the issue:\n\n```sql\nUPDATE users\nSET\n    email = CONCAT(\"<img src=https://cataas.com/cat/says/oops>\", users.idUser, \"@xxx\")\nWHERE\n    email NOT LIKE '%xxx%' AND email != \"demo@xxx.com\"\n```\n\nResult: \n\n![image](https://github.com/user-attachments/assets/c583816b-157c-474e-bbed-152b3dc0372f)\n\n### Impact\n\nAnyone looking at the Vitess status page is affected. This would normally be owners / administrators of the Vitess cluster.\n\nAnyone that can influence what text show up in queries can trigger it. This would normally be pretty much everybody interacting with a system that uses Vitess as a backend.\n\n## Affected packages\n\n- `vitess.io/vitess >= 0.21.0-rc1, < 0.21.1`\n- `vitess.io/vitess >= 0.20.0-rc1, < 0.20.4`\n- `vitess.io/vitess < 0.19.8`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `vitess.io/vitess 0.21.1`\n- `vitess.io/vitess 0.20.4`\n- `vitess.io/vitess 0.19.8`","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}