What is the CVSS score of CVE-2026-46624?

CVE-2026-46624 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Twenty CRM are affected by CVE-2026-46624?

Twenty CRM versions 1.7.7-1.16.7 contain a critical remote code execution vulnerability allowing authenticated users to execute arbitrary operating system commands on the database server, with no…

How to fix or mitigate CVE-2026-46624?

24 hours: Identify all Twenty CRM deployments running versions 1.7.7-1.16.7; verify whether the PostgreSQL application role holds superuser privileges. 7 days: Implement network segmentation to restrict database access to essential application servers only; enable comprehensive database activity monitoring and alerting on suspicious SQL command patterns. 30 days: Contact Twenty for patch availability and timeline; if no patch is released within 30 days, migrate to an alternative CRM solution or deploy an unaffected Twenty CRM version.

Twenty CRM CVE-2026-46624

EUVD-2026-31907 CRITICAL

OS Command Injection (CWE-78)

2026-05-26 GitHub_M

RCE SQLi PostgreSQL Command Injection Twenty

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:31 vuln.today

CVE Published

May 26, 2026 - 17:01 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint. The timeZone field within the group_by query parameter is directly interpolated into a raw SQL expression using JavaScript template literals without any parameterization, validation, or escaping. This affects engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts.

AnalysisAI

Remote code execution in Twenty CRM versions 1.7.7 through 1.16.7 allows authenticated users to execute arbitrary OS commands on the database server by chaining SQL injection in the REST API groupBy endpoint with PostgreSQL's COPY TO PROGRAM functionality. The unsanitized timeZone parameter is interpolated directly into raw SQL via JavaScript template literals, and exploitation succeeds whenever the application's Postgres role holds superuser privileges. Publicly available exploit code exists per SSVC, though EPSS scoring (0.15%) suggests exploitation activity has not yet become widespread.

Technical ContextAI

Twenty is an open-source CRM platform whose GraphQL/REST query runner builds PostgreSQL group_by expressions in engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts. The timeZone field inside the group_by query parameter is concatenated into a raw SQL fragment using JavaScript template literals, with no parameter binding, allow-listing, or escaping - a textbook CWE-78 (OS Command Injection) outcome enabled by SQL injection. PostgreSQL's COPY ... TO PROGRAM directive lets a superuser pipe query output through an OS command, so once SQLi is achieved on a database connection whose role has SUPERUSER, the injected statement reaches the underlying shell of the database host. The affected CPE is cpe:2.3:a:twentyhq:twenty covering all versions in the stated range.

RemediationAI

Upgrade Twenty CRM to a release later than 1.16.7 as described in the vendor advisory at https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573; the input data does not name a specific fixed tag, so upstream fix available per advisory but released patched version not independently confirmed - consult the GHSA before deploying. As immediate compensating controls, reconfigure the application's PostgreSQL role to remove SUPERUSER (this alone blocks COPY TO PROGRAM and downgrades the bug from RCE to SQLi, with the side effect that any Twenty features relying on superuser-only operations must be reviewed), block or proxy-filter the REST API groupBy endpoint at the reverse proxy to reject group_by parameters containing quote, semicolon, or COPY/PROGRAM tokens (may break legitimate group-by queries with unusual time zones), and restrict access to the API to trusted networks or via authenticated VPN since exploitation requires only a valid low-privilege account. Rotate database credentials and audit logs for unexpected COPY TO PROGRAM statements after patching.