{"id":"CVE-2026-104252","summary":"Vitess vttablet /twopcz reflected XSS","details":"Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.","aliases":["GHSA-v75v-6fpf-gvw8"],"modified":"2026-10-15T02:47:21.054771227Z","published":"2026-10-13T19:22:58.208Z","database_specific":{"cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104252.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/vitessio/vitess/releases/tag/v23.0.5"},{"type":"WEB","url":"https://github.com/vitessio/vitess/releases/tag/v24.0.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104252.json"},{"type":"ADVISORY","url":"https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104252"},{"type":"FIX","url":"https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2"},{"type":"FIX","url":"https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af"},{"type":"FIX","url":"https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7"},{"type":"FIX","url":"https://github.com/vitessio/vitess/pull/20255"},{"type":"FIX","url":"https://github.com/vitessio/vitess/pull/20273"},{"type":"FIX","url":"https://github.com/vitessio/vitess/pull/20274"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vitessio/vitess","events":[{"introduced":"0"},{"introduced":"e8d9fa81d351066497a8d99f92e9e9f2ecfd69d0"},{"fixed":"1e30dbc6658b7078eda58dd79969ce1f76cf132d"},{"fixed":"181d22c8f1dca63f5c8846be9b39f712a2412fff"},{"fixed":"3140c1846cd120db34f33b2083139b4ab638aed2"},{"fixed":"976e1e0d78f9d29d02e5e31b4aa7e180648f08af"},{"fixed":"c1ed96302e658190168c971afdac730cf70e43f7"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"23.0.5"},{"introduced":"24.0.0"},{"fixed":"24.0.2"}]}}],"versions":["v24.0.1","v0.24.1","v23.0.4","v0.23.4","v24.0.0","v0.24.0","v23.0.3","v0.23.3","v23.0.2","v0.23.2","v23.0.1","v0.23.1","v23.0.0","v0.23.0","v23.0.0-rc2","v0.23.0-rc2","v23.0.0-rc1","v0.23.0-rc1","v10.0.0-rc1-mysql80","v10.0.0-rc1","v9.0.0-rc1","v8.0.0-rc1","v7.0.0-beta","v6.0.0-rc.1","v5.0.1","v5.0.0","v3.0.0-rc.3","v3.0","v3.0.0-rc.2","v3.0.0-rc.1","v2.2.0-rc.1","v2.2-alpha","v2.2","v2.1.0-alpha.1","v2.0.0-rc.2","v2.0.0-rc.1","v2.0.0-beta.2","v2.0.0-alpha5","v2.0.0-alpha4","v2.0.0-alpha2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104252.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}