CVE-2026-105220

Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files

State: Published
Severity: 8.5 High
Published: Oct 4, 2026
Updated: Oct 5, 2026
Reserved: Oct 4, 2026

Description

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file, executing code as the user.

Scores

CVSS	Score	Vector	Source
4.0	8.5 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
twinejsklembot	2.12.0 and earlierAffected

References

GitHub Issue #1706issue-tracking
https://github.com/klembot/twinejsproduct
https://github.com/klembot/twinejs/blob/2.12.0/src/util/import.ts#L134-L136technical-description
https://github.com/klembot/twinejs/blob/2.12.0/src/electron/main-process/scratch-file.ts#L57-L63technical-description
https://github.com/klembot/twinejs/commit/8e8a2bef5b1e20c58b99d22a2a4d8d867fb421cbpatch
https://github.com/klembot/twinejs/commit/3a9af28cabe9684730beb8b578132cad9bb5bc60patch
VulnCheck Advisory: Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Filesthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.