Vulnerability-Lookup

GHSA-V75V-6FPF-GVW8

Vulnerability from github – Published: 2026-10-15 20:16 – Updated: 2026-10-15 20:16

Summary

Vitess vttablet /twopcz reflected XSS

Details

From: xylove21 To: security@vitess.io Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800

Summary

The twopczHandler in go/vt/vttablet/tabletserver/twopcz.go (line 185) reflects the Action and dtid form values directly into the HTML response body via fmt.Fprintln(w, msg) — without HTML escaping. The response is served as text/html; charset=utf-8, and Vitess's default acl policy is allow-all, so the endpoint is reachable by anyone who can hit the vttablet's HTTP port (default 15999, multiplexed with gRPC and MySQL wire-protocol ports).

A crafted Action or dtid value yields a reflected XSS that executes in the operator's browser with same-origin access to the vttablet's debug endpoints. This includes /queryz (live query plans), /querylogz (recent queries with bound values), /txlogz (transactions), /debug/env (environment variables — may include MySQL/topology credentials), /debug/vars (expvar stats), and /debug/pprof/* if enabled.

The bug was introduced before v20.0.0 (long-standing) and was silently fixed in commit 3140c1846c (merged 2026-06-09, PR #20255, "tabletserver: escape reflected form values in twopcz handler"). The fix replaces fmt.Fprintln(w, msg) with fmt.Fprintln(w, html.EscapeString(msg)). No released version of Vitess contains the fix — the fix lives only on main (current tip 33a3c0fafe69, 2026-06-23). There is no CVE, GHSA, or OSV entry for this specific bug (verified 2026-06-24 against GitHub Advisory Database, OSV.dev, and NVD).

Impact

Field	Value
Type	Reflected Cross-Site Scripting (XSS)
CVSS 3.1	`AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N` = 7.7 HIGH
Attack Vector	Network (vttablet HTTP port 15999, multiplexed with gRPC/MySQL)
Attack Complexity	Low (craft URL, send to operator)
Privileges Required	None (default `acl` policy is allow-all)
User Interaction	Required (operator must visit crafted URL)
Scope	Changed (XSS chain reaction to other vttablet debug endpoints)
Confidentiality	High (query text, env vars, expvar stats)
Integrity	None (XSS itself doesn't change state)
Availability	None (XSS itself doesn't disrupt service)

Affected versions (verified)

All released versions are vulnerable. The fix lives only on main:

Tag	Released	`twopcz.go` line 185	Status
v20.0.0	2024-06-27	`fmt.Fprintln(w, msg)`	BUGGY
v20.0.1 - v20.0.6	2024	`fmt.Fprintln(w, msg)`	BUGGY
v22.0.4	2026-02-27	`fmt.Fprintln(w, msg)`	BUGGY
v23.0.3, v23.0.4	2026-02 / 2026-05	`fmt.Fprintln(w, msg)`	BUGGY
v24.0.0, v24.0.1	2026-04 / 2026-05	`fmt.Fprintln(w, msg)`	BUGGY
main (`33a3c0fafe69`)	2026-06-23	`fmt.Fprintln(w, html.EscapeString(msg))`	FIXED

Sensitive data exposed via the same-origin XSS chain

A successful XSS lands in the vttablet's origin. From there, the attacker can fetch (via fetch() from injected JavaScript) the following same-origin endpoints, all of which are unauthenticated by default:

/twopcz — in-flight 2PC transactions (query text, parameters, dtid)
/queryz — live query plans
/querylogz — recent queries with bound values
/txlogz — transactions
/debug/env — environment variables (may include MySQL creds, topology credentials, encryption keys)
/debug/vars — expvar stats
/debug/pprof/* — CPU/memory profiles (if enabled)

Reproduction (independent, runnable PoC)

The PoC is a self-contained Go HTTP server that replicates the buggy twopczHandler from Vitess v20.0.0 verbatim (using the same line-185 code). It runs on 127.0.0.1:15080 and returns the same response shape as the real Vitess endpoint.

# 1) Build the PoC (Go 1.23+)
cd /path/to/finding/CVE-pending-twopcz-xss
go build -o /tmp/vitess-twopcz-poc ./poc.go

# 2) Start the buggy server
ADDR=127.0.0.1:15080 /tmp/vitess-twopcz-poc &

# 3) Reproduce — Test 1: bare GET (no params)
curl -sS -i "http://127.0.0.1:15080/twopcz"
# → Content-Type: text/html; charset=utf-8, status 200

# 4) Test 2: XSS via Action param (URL-encode the script tag)
curl -sS -i "http://127.0.0.1:15080/twopcz?Action=%3Cscript%3Ealert(1)%3C%2Fscript%3E&dtid=zz"
# → Response body contains literal "<script>alert(1)</script>(zz): completed."
# → Browser executes the script as same-origin code

# 5) Test 3: XSS via dtid param (attribute-context payload)
curl -sS -i "http://127.0.0.1:15080/twopcz?Action=Demo&dtid=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E"
# → Response body contains literal "<img src=x onerror=alert(1)>"
# → Browser fires the onerror handler as same-origin code

# 6) Run the 3x automated runner (writes evidence/run-{1,2,3}.log)
bash ./poc/run.sh

PoC result excerpt (from evidence/run-1.log):

--- Test 2: XSS via Action=<script>alert(1)</script> ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
...
<h2>WARNING: Actions on this page can jeopardize data integrity.</h2>
<script>alert(1)</script>(zz): completed.

PASS: payload reflected UNESCAPED (XSS exploitable in browser)

The PoC was run 3 times on the buggy server (all 3/3 PASS) and the same code is byte-identical to the v20.0.0 commit 8aeb274f6c8e line 185.

Root cause (technical detail)

go/vt/vttablet/tabletserver/twopcz.go (v20.0.0 through v24.0.1):

// Line 185
fmt.Fprintln(w, msg)

msg is constructed earlier in the handler as:

msg := fmt.Sprintf("%s(%s): completed.", action, dtid)

with action and dtid coming from the form values r.FormValue("Action") and r.FormValue("dtid"). The form values are URL-decoded (so a + becomes a space, %3C becomes <) but never HTML-escaped. The handler explicitly sets Content-Type: text/html; charset=utf-8 (via the <!DOCTYPE html> it writes first), so the browser executes any injected <script> or attribute-context payload.

The fix in main (fmt.Fprintln(w, html.EscapeString(msg))) closes the hole by HTML-escaping both action and dtid before reflection.

Suggested fix (already in main)

// Recommended minimal patch (already in main, needs backport to all release branches):
import "html"

func twopczHandler(w http.ResponseWriter, r *http.Request) {
    // ... existing logic ...
    msg := fmt.Sprintf("%s(%s): completed.", action, dtid)
    fmt.Fprintln(w, html.EscapeString(msg))  // ← was: fmt.Fprintln(w, msg)
}

Backport the fix to v20.0.x, v22.0.x, v23.0.x, and v24.0.x as patch releases. The fix is one line and a one-line import "html" addition, so the backport risk is minimal.

Workaround / mitigation (no patch available)

If you cannot upgrade to a fixed release immediately:

Restrict the vttablet HTTP port (default 15999) to localhost only. vttablet can run with --tablet-allow-stats=false and --tablet-grpc-port configured separately from the HTTP port, or you can firewall the HTTP port at the network layer. The debug endpoints are not needed by production traffic.
Set a non-default ACL policy. Vitess supports an acl policy that defaults to allow-all. Setting it to a JSON file that denies unauthenticated access to debug endpoints (see go/acl/acl.go::savePolicy) would block the XSS, but the default policy is currently "" (allow-all) and many users don't override it.
Use a reverse proxy (nginx, envoy) in front of the vttablet HTTP port with a strict allowlist of clients.

Cross-references

The bug is not related to:
- CVE-2024-53257 (/debug/querylogz HTML injection, fixed in v20.0.4 — different endpoint)
- CVE-2026-27969 (backup MANIFEST path traversal)
- CVE-2026-27965 / GHSA-8g8j-r87h-p36x (backup external decompressor RCE)
PR #20255 is the fix commit; PR #19486 (defense-in-depth) is a separate hardening change

Contact

GitHub: @xylove21

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "vitess.io/vitess"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "vitess.io/vitess"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.24.0"
            },
            {
              "fixed": "0.24.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-104252"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-79",
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-15T20:16:29Z",
    "nvd_published_at": "2026-10-13T20:17:12Z",
    "severity": "CRITICAL"
  },
  "details": "From: xylove21\nTo: security@vitess.io\nSubject: [Security Report] Vitess vttablet /twopcz reflected XSS\nDate: Tue, 24 Jun 2026 14:30:00 +0800\n\n## Summary\n\nThe `twopczHandler` in\n`go/vt/vttablet/tabletserver/twopcz.go` (line 185) reflects the `Action`\nand `dtid` form values directly into the HTML response body via\n`fmt.Fprintln(w, msg)` \u2014 **without HTML escaping**. The response is served\nas `text/html; charset=utf-8`, and Vitess\u0027s default `acl` policy is\n**allow-all**, so the endpoint is reachable by anyone who can hit the\nvttablet\u0027s HTTP port (default `15999`, multiplexed with gRPC and MySQL\nwire-protocol ports).\n\nA crafted `Action` or `dtid` value yields a **reflected XSS** that\nexecutes in the operator\u0027s browser with same-origin access to the\nvttablet\u0027s debug endpoints. This includes `/queryz` (live query plans),\n`/querylogz` (recent queries with bound values), `/txlogz` (transactions),\n`/debug/env` (environment variables \u2014 may include MySQL/topology\ncredentials), `/debug/vars` (expvar stats), and `/debug/pprof/*` if\nenabled.\n\nThe bug was introduced before v20.0.0 (long-standing) and was silently\nfixed in commit `3140c1846c` (merged 2026-06-09, PR #20255,\n\"tabletserver: escape reflected form values in twopcz handler\"). The\nfix replaces `fmt.Fprintln(w, msg)` with\n`fmt.Fprintln(w, html.EscapeString(msg))`. **No released version of\nVitess contains the fix** \u2014 the fix lives only on `main` (current tip\n`33a3c0fafe69`, 2026-06-23). There is **no CVE, GHSA, or OSV entry**\nfor this specific bug (verified 2026-06-24 against GitHub Advisory\nDatabase, OSV.dev, and NVD).\n\n## Impact\n\n| Field | Value |\n|-------|-------|\n| **Type** | Reflected Cross-Site Scripting (XSS) |\n| **CVSS 3.1** | `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N` = **7.7 HIGH** |\n| **Attack Vector** | Network (vttablet HTTP port 15999, multiplexed with gRPC/MySQL) |\n| **Attack Complexity** | Low (craft URL, send to operator) |\n| **Privileges Required** | None (default `acl` policy is allow-all) |\n| **User Interaction** | Required (operator must visit crafted URL) |\n| **Scope** | Changed (XSS chain reaction to other vttablet debug endpoints) |\n| **Confidentiality** | High (query text, env vars, expvar stats) |\n| **Integrity** | None (XSS itself doesn\u0027t change state) |\n| **Availability** | None (XSS itself doesn\u0027t disrupt service) |\n\n### Affected versions (verified)\n\nAll released versions are vulnerable. The fix lives only on `main`:\n\n| Tag | Released | `twopcz.go` line 185 | Status |\n|---|---|---|---|\n| v20.0.0 | 2024-06-27 | `fmt.Fprintln(w, msg)` | **BUGGY** |\n| v20.0.1 - v20.0.6 | 2024 | `fmt.Fprintln(w, msg)` | **BUGGY** |\n| v22.0.4 | 2026-02-27 | `fmt.Fprintln(w, msg)` | **BUGGY** |\n| v23.0.3, v23.0.4 | 2026-02 / 2026-05 | `fmt.Fprintln(w, msg)` | **BUGGY** |\n| v24.0.0, v24.0.1 | 2026-04 / 2026-05 | `fmt.Fprintln(w, msg)` | **BUGGY** |\n| **main** (`33a3c0fafe69`) | 2026-06-23 | `fmt.Fprintln(w, html.EscapeString(msg))` | **FIXED** |\n\n### Sensitive data exposed via the same-origin XSS chain\n\nA successful XSS lands in the vttablet\u0027s origin. From there, the\nattacker can fetch (via `fetch()` from injected JavaScript) the\nfollowing same-origin endpoints, all of which are unauthenticated by\ndefault:\n\n- `/twopcz` \u2014 in-flight 2PC transactions (query text, parameters, dtid)\n- `/queryz` \u2014 live query plans\n- `/querylogz` \u2014 recent queries with bound values\n- `/txlogz` \u2014 transactions\n- `/debug/env` \u2014 environment variables (may include MySQL creds, topology\n  credentials, encryption keys)\n- `/debug/vars` \u2014 expvar stats\n- `/debug/pprof/*` \u2014 CPU/memory profiles (if enabled)\n\n## Reproduction (independent, runnable PoC)\n\nThe PoC is a self-contained Go HTTP server that replicates the buggy\n`twopczHandler` from Vitess v20.0.0 verbatim (using the same line-185\ncode). It runs on `127.0.0.1:15080` and returns the same response shape\nas the real Vitess endpoint.\n\n```bash\n# 1) Build the PoC (Go 1.23+)\ncd /path/to/finding/CVE-pending-twopcz-xss\ngo build -o /tmp/vitess-twopcz-poc ./poc.go\n\n# 2) Start the buggy server\nADDR=127.0.0.1:15080 /tmp/vitess-twopcz-poc \u0026\n\n# 3) Reproduce \u2014 Test 1: bare GET (no params)\ncurl -sS -i \"http://127.0.0.1:15080/twopcz\"\n# \u2192 Content-Type: text/html; charset=utf-8, status 200\n\n# 4) Test 2: XSS via Action param (URL-encode the script tag)\ncurl -sS -i \"http://127.0.0.1:15080/twopcz?Action=%3Cscript%3Ealert(1)%3C%2Fscript%3E\u0026dtid=zz\"\n# \u2192 Response body contains literal \"\u003cscript\u003ealert(1)\u003c/script\u003e(zz): completed.\"\n# \u2192 Browser executes the script as same-origin code\n\n# 5) Test 3: XSS via dtid param (attribute-context payload)\ncurl -sS -i \"http://127.0.0.1:15080/twopcz?Action=Demo\u0026dtid=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E\"\n# \u2192 Response body contains literal \"\u003cimg src=x onerror=alert(1)\u003e\"\n# \u2192 Browser fires the onerror handler as same-origin code\n\n# 6) Run the 3x automated runner (writes evidence/run-{1,2,3}.log)\nbash ./poc/run.sh\n```\n\nPoC result excerpt (from `evidence/run-1.log`):\n\n```\n--- Test 2: XSS via Action=\u003cscript\u003ealert(1)\u003c/script\u003e ---\nHTTP/1.1 200 OK\nContent-Type: text/html; charset=utf-8\n...\n\u003ch2\u003eWARNING: Actions on this page can jeopardize data integrity.\u003c/h2\u003e\n\u003cscript\u003ealert(1)\u003c/script\u003e(zz): completed.\n\nPASS: payload reflected UNESCAPED (XSS exploitable in browser)\n```\n\nThe PoC was run 3 times on the buggy server (all 3/3 PASS) and the same\ncode is byte-identical to the v20.0.0 commit `8aeb274f6c8e` line 185.\n\n## Root cause (technical detail)\n\n`go/vt/vttablet/tabletserver/twopcz.go` (v20.0.0 through v24.0.1):\n\n```go\n// Line 185\nfmt.Fprintln(w, msg)\n```\n\n`msg` is constructed earlier in the handler as:\n\n```go\nmsg := fmt.Sprintf(\"%s(%s): completed.\", action, dtid)\n```\n\nwith `action` and `dtid` coming from the form values\n`r.FormValue(\"Action\")` and `r.FormValue(\"dtid\")`. The form values are\nURL-decoded (so a `+` becomes a space, `%3C` becomes `\u003c`) but never\nHTML-escaped. The handler explicitly sets `Content-Type: text/html;\ncharset=utf-8` (via the `\u003c!DOCTYPE html\u003e` it writes first), so the\nbrowser executes any injected `\u003cscript\u003e` or attribute-context payload.\n\nThe fix in main (`fmt.Fprintln(w, html.EscapeString(msg))`) closes the\nhole by HTML-escaping both `action` and `dtid` before reflection.\n\n## Suggested fix (already in main)\n\n```go\n// Recommended minimal patch (already in main, needs backport to all release branches):\nimport \"html\"\n\nfunc twopczHandler(w http.ResponseWriter, r *http.Request) {\n    // ... existing logic ...\n    msg := fmt.Sprintf(\"%s(%s): completed.\", action, dtid)\n    fmt.Fprintln(w, html.EscapeString(msg))  // \u2190 was: fmt.Fprintln(w, msg)\n}\n```\n\nBackport the fix to v20.0.x, v22.0.x, v23.0.x, and v24.0.x as patch\nreleases. The fix is one line and a one-line `import \"html\"` addition,\nso the backport risk is minimal.\n\n## Workaround / mitigation (no patch available)\n\nIf you cannot upgrade to a fixed release immediately:\n\n1. **Restrict the vttablet HTTP port** (default 15999) to localhost\n   only. vttablet can run with `--tablet-allow-stats=false` and\n   `--tablet-grpc-port` configured separately from the HTTP port, or\n   you can firewall the HTTP port at the network layer. The debug\n   endpoints are not needed by production traffic.\n\n2. **Set a non-default ACL policy**. Vitess supports an `acl` policy\n   that defaults to allow-all. Setting it to a JSON file that denies\n   unauthenticated access to debug endpoints (see\n   `go/acl/acl.go::savePolicy`) would block the XSS, but the default\n   policy is currently `\"\"` (allow-all) and many users don\u0027t override\n   it.\n\n3. **Use a reverse proxy** (nginx, envoy) in front of the vttablet\n   HTTP port with a strict allowlist of clients.\n\n## Cross-references\n\n  - The bug is **not** related to:\n    - CVE-2024-53257 (`/debug/querylogz` HTML injection, fixed in\n      v20.0.4 \u2014 different endpoint)\n    - CVE-2026-27969 (backup MANIFEST path traversal)\n    - CVE-2026-27965 / GHSA-8g8j-r87h-p36x (backup external decompressor\n      RCE)\n  - PR #20255 is the fix commit; PR #19486 (defense-in-depth) is a\n    separate hardening change\n\n## Contact\n\n  - GitHub: @xylove21",
  "id": "GHSA-v75v-6fpf-gvw8",
  "modified": "2026-10-15T20:16:29Z",
  "published": "2026-10-15T20:16:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104252"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/pull/20255"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/pull/20273"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/pull/20274"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vitessio/vitess"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/releases/tag/v23.0.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/releases/tag/v24.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vitess vttablet /twopcz reflected XSS"
}

CVE-2026-104252 (GCVE-0-2026-104252)

Vulnerability from cvelistv5 – Published: 2026-10-13 19:22 – Updated: 2026-10-15 15:11

Title

Vitess vttablet /twopcz reflected XSS

Summary

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 13:23 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

9 references

URL	Tags
https://github.com/vitessio/vitess/security/advis…	x_refsource_CONFIRM
https://github.com/vitessio/vitess/pull/20255	x_refsource_MISC
https://github.com/vitessio/vitess/pull/20273	x_refsource_MISC
https://github.com/vitessio/vitess/pull/20274	x_refsource_MISC
https://github.com/vitessio/vitess/commit/3140c18…	x_refsource_MISC
https://github.com/vitessio/vitess/commit/976e1e0…	x_refsource_MISC
https://github.com/vitessio/vitess/commit/c1ed963…	x_refsource_MISC
https://github.com/vitessio/vitess/releases/tag/v23.0.5	x_refsource_MISC
https://github.com/vitessio/vitess/releases/tag/v24.0.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vitessio	vitess	Affected: < 23.0.5 Affected: >= 24.0.0, < 24.0.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104252",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T13:23:55.916133Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:11:35.194Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vitess",
          "vendor": "vitessio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 23.0.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 24.0.0, \u003c 24.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator\u0027s browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T19:22:58.208Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8"
        },
        {
          "name": "https://github.com/vitessio/vitess/pull/20255",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitessio/vitess/pull/20255"
        },
        {
          "name": "https://github.com/vitessio/vitess/pull/20273",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitessio/vitess/pull/20273"
        },
        {
          "name": "https://github.com/vitessio/vitess/pull/20274",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitessio/vitess/pull/20274"
        },
        {
          "name": "https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2"
        },
        {
          "name": "https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af"
        },
        {
          "name": "https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7"
        },
        {
          "name": "https://github.com/vitessio/vitess/releases/tag/v23.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitessio/vitess/releases/tag/v23.0.5"
        },
        {
          "name": "https://github.com/vitessio/vitess/releases/tag/v24.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitessio/vitess/releases/tag/v24.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-v75v-6fpf-gvw8",
        "discovery": "UNKNOWN"
      },
      "title": "Vitess vttablet /twopcz reflected XSS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-104252",
    "datePublished": "2026-10-13T19:22:58.208Z",
    "dateReserved": "2026-10-01T19:04:39.706Z",
    "dateUpdated": "2026-10-15T15:11:35.194Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-V75V-6FPF-GVW8

Summary

Impact

Affected versions (verified)

Sensitive data exposed via the same-origin XSS chain

Reproduction (independent, runnable PoC)

Root cause (technical detail)

Suggested fix (already in main)

Workaround / mitigation (no patch available)

Cross-references

Contact

CVE-2026-104252 (GCVE-0-2026-104252)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour