GHSA-8g8j-r87h-p36x

Suggest an improvement
Source
https://github.com/advisories/GHSA-8g8j-r87h-p36x
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-8g8j-r87h-p36x/GHSA-8g8j-r87h-p36x.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8g8j-r87h-p36x
Aliases
Published
2026-02-26T22:50:37Z
Modified
2026-02-27T02:03:00.614956Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L CVSS Calculator
Summary
Vitess users with backup storage access can gain unauthorized access to production deployment environments
Details

Impact

Any user with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that arbitrary code is later executed when that backup is restored. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there.

Patches

Fixes are expected to be released with versions v23.0.3 and v22.0.4 See fix commit at https://github.com/vitessio/vitess/commit/4c0173293907af9cb942a6683c465c3f1e9fdb5c

Workarounds

If maintainers intended to use an external decompressor then they can always specify that decompressor command in the --external-decompressor flag value for vttablet and vtbackup. That then overrides any value specified in the manifest file.

If maintainers did not intend to use an external decompressor, nor an internal one, then they can specify a value such as cat or tee in the --external-decompressor flag value for vttablet and vtbackup to ensure that a harmless command is always used.

References

Users can read more about the issue here: https://github.com/vitessio/vitess/issues/19459

Database specific 
{
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-78"
    ],
    "github_reviewed_at": "2026-02-26T22:50:37Z",
    "nvd_published_at": "2026-02-26T02:16:23Z"
}
References

Affected packages

Go / vitess.io/vitess

Package

Name
vitess.io/vitess
View open source insights on deps.dev
Purl
pkg:golang/vitess.io/vitess

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.23.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-8g8j-r87h-p36x/GHSA-8g8j-r87h-p36x.json"