Twine 2 Desktop: Cross-site scripting via imported story files
Summary
Twine 2 desktop up to and including 2.12.0 does not safely handle imported story files. Markup in an imported story file runs in the editor window, and a crafted script can call the application's internal bridge to write and open a .bat file. An attacker can thus execute code with the rights of the user who imports and opens the file, so user interaction is required.
Affected
- klembot Twine 2 desktop (twinejs) versions 0 to 2.12.0 inclusive
Fixed in
- Unknown. No confirmed fixed version was found. Check the upstream releases page.
Workaround
- No vendor-confirmed workaround.
- Do not import story files from untrusted sources (email, forums, chat, USB).
Exploitation
- The CISA SSVC assessment in the CVE record lists exploitation status 'poc' (proof of concept) and 'Automatable: no'.
- No evidence of exploitation in the wild was found in the sources reviewed.
Our recommendation
- Inventory Twine installations on workstations.
- Remove Twine where it is not needed, and run it as a standard user elsewhere.
- Import story files only from trusted sources.
- Update to a fixed release once the vendor confirms one.
- Monitor the upstream issue and releases page for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Upstream issue #1706 github.com
- Fix commit 8e8a2bef github.com
- Fix commit 3a9af28c github.com
- Vulnerable code: import.ts (2.12.0) github.com
- Vulnerable code: scratch-file.ts (2.12.0) github.com
- OSV entry CVE-2026-105220 osv.dev
- Upstream pull request #1715 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:31.
Original description (NVD)
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file, executing code as the user.
NVD references (8)
- https://github.com/klembot/twinejs
- https://github.com/klembot/twinejs/blob/2.12.0/src/electron/main-process/scratch-file.ts#L57-L63
- https://github.com/klembot/twinejs/blob/2.12.0/src/util/import.ts#L134-L136
- https://github.com/klembot/twinejs/commit/3a9af28cabe9684730beb8b578132cad9bb5bc60
- https://github.com/klembot/twinejs/commit/8e8a2bef5b1e20c58b99d22a2a4d8d867fb421cb
- https://github.com/klembot/twinejs/issues/1706
- https://www.vulncheck.com/advisories/twine-2-desktop-through-2.12.0-arbitrary-code-execution-via-imported-sto…
- https://github.com/klembot/twinejs/issues/1706
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.