Twine 2 CVE-2026-105220

Requires the victim to import an attacker-crafted Twine story file into the Twine 2 desktop (Electron) application, version 2.12.0 or earlier; the importStories() function executes untrusted markup from the imported file in the editor window, and the payload must invoke the Electron twineElectron openWithScratchFile IPC bridge to write and open a .bat file. Exploitation is limited by the need for user interaction (the victim must actively import the malicious file) and is specific to the Electron desktop build, since the openWithScratchFile IPC bridge is not present in a plain browser context. No authentication or special configuration is required (PR:N), but delivery depends on social engineering to get the target to import the file.

The CVSS 4.0 base score of 8.5 (High) reflects a serious outcome - full code execution (VC:H/VI:H/VA:H) as the logged-in user - but the signals temper the real-world urgency. The vector is Local (AV:L) and requires passive user interaction (UI:P): the victim must obtain and import a crafted story file, so this is not remotely or automatically exploitable despite PR:N. No EPSS score, no CISA KEV listing, and no POC indicator were provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. This is best characterized as a genuine arbitrary-code-execution bug that is high-impact but gated behind social engineering and a niche application, rather than a mass-exploitable emergency. No SSVC decision data (exploitation status, automatable, technical impact) was supplied, so an SSVC-based prioritization cannot be derived from the input. The confidentiality/integrity/availability impacts are confirmed by the description (write-and-execute a .bat as the user); the limiting factor is the delivery requirement, which should drive prioritization below network-reachable unauthenticated RCEs.

An attacker distributes a seemingly benign Twine story file through a forum, shared project, or direct message. When a victim imports it into Twine 2 desktop (≤2.12.0), markup embedded in the file is executed by importStories() in the editor window and calls the twineElectron openWithScratchFile IPC bridge to write and launch a .bat file, running arbitrary commands with the victim's privileges. No public exploit code was identified at time of analysis, though VulnCheck's advisory documents the technique and the local, user-interaction-dependent vector means the attacker relies on convincing the target to import the file.