CVE-2026-104252
Vitess vttablet /twopcz reflected XSS
From: xylove21 To: security@vitess.io Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1)
- EPSS
- 0.89% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vitess.io/vitess (go) < 0.23.5, fixed in 0.23.5 · GHSA-v75v-6fpf-gvw8
- vitess.io/vitess (go) >= 0.24.0, < 0.24.2, fixed in 0.24.2 · GHSA-v75v-6fpf-gvw8