{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "vitessio vitess: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/vitessio--vitess/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/vitessio--vitess/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104252/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104252/",
   "title": "CVE-2026-104252 disclosed",
   "content_text": "Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.",
   "date_published": "2026-10-13T19:22:58Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104252/fixed/go",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104252/",
   "title": "CVE-2026-104252 fixed upstream (Go)",
   "content_text": "Fixed versions: vitess.io/vitess 0.23.5, vitess.io/vitess 0.24.2.",
   "date_published": "2026-10-13T19:22:58Z"
  }
 ]
}