{"id":"CVE-2026-104252","published":"2026-10-13T20:17:12.453","lastModified":"2026-10-16T16:00:33.533","description":"Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2","tags":[]},{"url":"https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af","tags":[]},{"url":"https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7","tags":[]},{"url":"https://github.com/vitessio/vitess/pull/20255","tags":[]},{"url":"https://github.com/vitessio/vitess/pull/20273","tags":[]},{"url":"https://github.com/vitessio/vitess/pull/20274","tags":[]},{"url":"https://github.com/vitessio/vitess/releases/tag/v23.0.5","tags":[]},{"url":"https://github.com/vitessio/vitess/releases/tag/v24.0.2","tags":[]},{"url":"https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8","tags":[]}],"exploitRefs":[{"url":"https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2","tags":[]},{"url":"https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af","tags":[]},{"url":"https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7","tags":[]},{"url":"https://github.com/vitessio/vitess/pull/20255","tags":[]},{"url":"https://github.com/vitessio/vitess/pull/20273","tags":[]},{"url":"https://github.com/vitessio/vitess/pull/20274","tags":[]},{"url":"https://github.com/vitessio/vitess/releases/tag/v23.0.5","tags":[]},{"url":"https://github.com/vitessio/vitess/releases/tag/v24.0.2","tags":[]},{"url":"https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8","tags":[]}],"hasPoc":true,"ai":{"summary":"Vitess database system contains a cross-site scripting vulnerability in its debug endpoint that allows unauthenticated attackers to inject malicious scripts into HTML responses. When an operator opens a crafted request, the script executes in their browser with the vttablet's security context, potentially exposing sensitive diagnostic data.","exploitability":"Easy to exploit with no prerequisites - attackers need only send a crafted HTTP request to a vulnerable vttablet or vtcombo instance, and can rely on operator interaction to trigger execution.","blast_radius":"High impact in environments where operators frequently interact with debug endpoints, potentially exposing sensitive query data, transaction details, and profiling information to attackers.","remediation":"Upgrade to Vitess version 23.0.5 or 24.0.2 immediately to patch the XSS vulnerability in the /twopcz debug endpoint.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","database","web","debug"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:52:36.379Z"}}