CyberRota Analysis
AI-GeneratedTwine 2 desktop versions up to 2.12.0 are vulnerable to a cross-site scripting flaw in the importStories() function, allowing attackers to execute arbitrary code by crafting malicious story files. This vulnerability can lead to unauthorized code execution on the user's machine, posing a significant risk to users who import untrusted content. Developers and organizations using Twine for interactive storytelling should prioritize patching this vulnerability to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file, executing code as the user.