-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from using text/template instead of html/template or safehtml/template. The commit diff shows replacement of text/template with safehtml/template across 4 handler files serving /debug endpoints. These files contain HTTP handlers that render monitoring pages without proper context-aware escaping, allowing HTML injection through user-controlled query content. The test file modifications demonstrate injected script tags in SQL queries were previously unescaped. High confidence as the file changes directly correlate with the described vulnerability mechanism and CWE-79.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vitess.io/vitess | go | >= 0.21.0-rc1, < 0.21.1 | 0.21.1 |
| vitess.io/vitess | go | >= 0.20.0-rc1, < 0.20.4 | 0.20.4 |
| vitess.io/vitess | go | < 0.19.8 | 0.19.8 |