Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.5

Twine 2 Desktop can run malicious code from imported files

CVE-2026-105220 · published 14 days ago
Summary

Twine 2 Desktop versions up to 2.12.0 allow story files to execute code when they are opened in the editor. An attacker could create a specially crafted story file that runs a batch script on the user’s computer. Update to the latest version of Twine or only open story files from trusted sources to protect yourself.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
klembot twinejs <= 2.12.0
Original advisory text
Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file, executing code as the user.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published4 Oct 2026
Updated14 Oct 2026
First seen4 Oct 2026
Sources
CVE-2026-105220 · NVD
CVE-2026-105220 · MITRE
CVE-2026-105220 · OSV
Track software like this
Free during beta