CVE-2026-105220

Received Received - Intake

Cross-Site Scripting in Twine 2 Desktop via Imported Story Files

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: VulnCheck

Description

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file, executing code as the user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-04

Last Modified

2026-10-04

Generated

2026-10-05

AI Q&A

2026-10-05

EPSS Evaluated

N/A

NVD

CVE-2026-105220

EUVD

EUVD-2026-92133

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in Twine 2 desktop versions up to 2.12.0. It allows attackers to execute malicious scripts by importing a specially crafted story file. The script can then use the twineElectron openWithScratchFile IPC bridge to write and open a .bat file, which executes code on the user's system.

Detection Guidance

Detecting this vulnerability requires checking for Twine 2 desktop installations through version 2.12.0. Inspect installed software versions and review imported story files for suspicious scripts. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to run arbitrary code on your computer, potentially stealing data, installing malware, or taking control of your system. Since it requires user interaction to import a malicious file, the risk depends on whether you open untrusted story files.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using Twine may face compliance violations if exploited.

Mitigation Strategies

Immediately update Twine 2 desktop to the latest version beyond 2.12.0. Avoid importing untrusted story files. Disable or restrict the twineElectron openWithScratchFile IPC bridge if possible.

Hi! I’m here to help you understand CVE-2026-105220. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70