EUVD-2026-92133

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...

CVE-2026-105220

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...

CVE-2026-105220 Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...

CVE-2026-105220

Twine 2 Desktop (versions through 2.12.0 ) is vulnerable to Arbitrary Code Execution due to a cross-site scripting (XSS) flaw in the importStories() function. The root cause is a failure to properly sanitize markup during the import of story files, which allows malicious scripts to execute within...

CVE-2026-105220 Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...

CVE-2026-105220 Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...

CVE-2026-105220: Improper Neutralization of Input During Web Page Generation

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...

PT-2026-104654

Name of the Vulnerable Software and Affected Versions Twine 2 desktop versions prior to 2.12.1 Description A cross-site scripting issue exists in the importStories function that allows the execution of markup from imported story files within the editor window. An attacker can create a malicious...