critical vulnerability

Vitess vttablet /twopcz reflected XSS

Fix availableCritical · CVSS 9.8EPSS 0.89%

Published Oct 15, 2026 · updated Oct 15, 2026

What to do

Upgrade to a fixed version: vitess.io/vitess 0.23.5, vitess.io/vitess 0.24.2.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Govitess.io/vitess

Vulnerable versions: < 0.23.5
Fixed in: 0.23.5

Check your project: go list -m all | grep vitess.io/vitess

Govitess.io/vitess

Vulnerable versions: >= 0.24.0, < 0.24.2
Fixed in: 0.24.2

Check your project: go list -m all | grep vitess.io/vitess

Sources

GitHub Advisory GHSA-v75v-6fpf-gvw8
NVD CVE-2026-104252

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') · CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · CWE-116 Improper Encoding or Escaping of Output

← All critical vulnerabilities