CVE-2024-53257: Vitess allows HTML injection in /debug/querylogz & /debug/env

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-03 · updated 2026-06-17
Weakness: CWE-79

Description

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.

Affected products

vitessio Vitess: before 19.0.8; from 19.0.9 before 20.0.4; from 20.0.5 before 21.0.1 — fixed in 19.0.8, 20.0.4, 21.0.1

How to fix

Upgrade to a fixed version: vitessio Vitess 19.0.8, 20.0.4, 21.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-53257 or the next vulnerability affects your stack