{"id":"CVE-2026-105220","published":"2026-10-04T23:16:59.627","lastModified":"2026-10-06T16:08:43.180","description":"Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file, executing code as the user.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/klembot/twinejs","tags":[]},{"url":"https://github.com/klembot/twinejs/blob/2.12.0/src/electron/main-process/scratch-file.ts#L57-L63","tags":[]},{"url":"https://github.com/klembot/twinejs/blob/2.12.0/src/util/import.ts#L134-L136","tags":[]},{"url":"https://github.com/klembot/twinejs/commit/3a9af28cabe9684730beb8b578132cad9bb5bc60","tags":[]},{"url":"https://github.com/klembot/twinejs/commit/8e8a2bef5b1e20c58b99d22a2a4d8d867fb421cb","tags":[]},{"url":"https://github.com/klembot/twinejs/issues/1706","tags":[]},{"url":"https://www.vulncheck.com/advisories/twine-2-desktop-through-2.12.0-arbitrary-code-execution-via-imported-story-files","tags":[]},{"url":"https://github.com/klembot/twinejs/issues/1706","tags":[]}],"exploitRefs":[{"url":"https://github.com/klembot/twinejs","tags":[]},{"url":"https://github.com/klembot/twinejs/blob/2.12.0/src/electron/main-process/scratch-file.ts#L57-L63","tags":[]},{"url":"https://github.com/klembot/twinejs/blob/2.12.0/src/util/import.ts#L134-L136","tags":[]},{"url":"https://github.com/klembot/twinejs/commit/3a9af28cabe9684730beb8b578132cad9bb5bc60","tags":[]},{"url":"https://github.com/klembot/twinejs/commit/8e8a2bef5b1e20c58b99d22a2a4d8d867fb421cb","tags":[]},{"url":"https://github.com/klembot/twinejs/issues/1706","tags":[]},{"url":"https://github.com/klembot/twinejs/issues/1706","tags":[]}],"hasPoc":true,"ai":{"summary":"Twine 2 desktop versions through 2.12.0 are vulnerable to cross-site scripting, allowing attackers to execute code as the user by crafting a malicious story file.","exploitability":"Exploitation requires attackers to craft a specific story file and have the target open it, making it moderately difficult.","blast_radius":"If exploited, the vulnerability could lead to full compromise of the user's system, including execution of arbitrary code.","remediation":"Upgrade to Twine 2.12.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","xss"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:59:18.134Z"}}