{"cve":"CVE-2026-104252","nvd":{"published":"2026-10-13T20:17:12.453","modified":"2026-10-23T15:14:48.240","status":"Analyzed","description":"Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-79"],"references":["https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2","https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af","https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7","https://github.com/vitessio/vitess/pull/20255","https://github.com/vitessio/vitess/pull/20273"],"products":["linuxfoundation:vitess"],"source":"nvd","synced_at":"2026-10-23T16:39:26.291718493+00:00"},"epss":{"cve":"CVE-2026-104252","score":0.01174,"percentile":0.67291,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-v75v-6fpf-gvw8","url":"https://osv.dev/vulnerability/GHSA-v75v-6fpf-gvw8","summary":"Vitess vttablet /twopcz reflected XSS","modified":"2026-10-15T20:30:05.447638204Z","packages":[{"ecosystem":"Go","name":"vitess.io/vitess","purl":"pkg:golang/vitess.io/vitess","ranges":["<0.23.5"],"fixed":["0.23.5"]},{"ecosystem":"Go","name":"vitess.io/vitess","purl":"pkg:golang/vitess.io/vitess","ranges":[">=0.24.0 <0.24.2"],"fixed":["0.24.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}