The flaw exists in Vitess vttablet’s /twopcz debug handler, which inserts unescaped user‑controlled values into an HTML response. This results in a reflected XSS (CWE‑79) that can execute arbitrary JavaScript within the operator’s browser context. Because the script runs under the vttablet debug origin, it can read diagnostic data—including queries, transactions, environment variables, and profiling information—exposing potentially sensitive information from the deployment.

The vulnerability affects every Vitess instance utilizing versions prior to 23.0.5 and 24.0.2. The fix was introduced in release 23.0.5 for the 23.x line and in 24.0.2 for the 24.x line. Operators or administrators deploying earlier releases are susceptible unless the endpoint is blocked or removed.

The CVSS score of 9.8 categorises this as critical. EPSS data is presently unavailable, but the absence of a KEV flag does not diminish the risk. The likely attack vector is a remote unauthenticated request targeting the /twopcz debug endpoint; the attacker must craft a request that the operator receives, and the script will execute in that operator’s browser, permitting access to same‑origin diagnostic resources.