CVE-2026-104252: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in vitessio vitess

Vitess, a MySQL clustering system, contains a cross-site scripting vulnerability in the twopczHandler component located in go/vt/vttablet/tabletserver/twopcz.go. The handler writes the 'Action' and 'dtid' form values from the /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, this enables a remote unauthenticated attacker to craft a request that executes arbitrary script in the operator's browser. The script runs with the vttablet debug origin and can access same-origin diagnostic endpoints exposing query, transaction, environment, variable, or profiling data. This vulnerability is addressed in Vitess versions 23.0.5 and 24.0.2.

An unauthenticated remote attacker can execute arbitrary scripts in the browser of an operator who opens a maliciously crafted request to the /twopcz debug endpoint. This script executes with the debug origin and can access sensitive diagnostic data such as queries, transactions, environment variables, and profiling information. The CVSS score is 9.8 (critical), indicating high impact on confidentiality, integrity, and availability.

Upgrade Vitess to version 23.0.5 or later, or to version 24.0.2 or later, where this vulnerability is fixed. No other mitigation is indicated or required according to the vendor advisory.