Twentyhq
Monthly
SQL injection in Twenty, an open-source CRM platform, lets a workspace administrator holding the DATA_MODEL permission inject arbitrary PostgreSQL into the DDL of the system searchVector TS_VECTOR field. By supplying a crafted settings.asExpression via PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, the attacker breaks out of the GENERATED ALWAYS AS (...) column clause and executes statements as the application database user, compromising all workspace data. It is fixed in 2.15.0, requires authenticated high-privilege access (CVSS 9.1, PR:H), and has no public exploit identified at time of analysis.
Cross-workspace data disclosure in Twenty CRM before 2.9.0 lets any authenticated user holding the AI settings flag (a workspace owner by default) read another tenant's AI agent chat history and trigger LLM evaluations against the victim's data on the same instance. By supplying a victim's agentId or turnId to the agentTurns query or evaluateAgentTurn mutation, an attacker retrieves raw chat text, tool calls, and tool outputs that belong to a different workspace. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Twenty CRM versions 1.7.7 through 1.16.7 allows authenticated users to execute arbitrary OS commands on the database server by chaining SQL injection in the REST API groupBy endpoint with PostgreSQL's COPY TO PROGRAM functionality. The unsanitized timeZone parameter is interpolated directly into raw SQL via JavaScript template literals, and exploitation succeeds whenever the application's Postgres role holds superuser privileges. Publicly available exploit code exists per SSVC, though EPSS scoring (0.15%) suggests exploitation activity has not yet become widespread.
Stored cross-site scripting in Twenty CRM versions 1.18.0 and earlier allows authenticated users to upload HTML/JavaScript files that the application then serves without security headers, enabling execution in the CRM's origin. Successful exploitation leads to session hijacking, account takeover, and theft of CRM data. No public exploit identified at time of analysis, and EPSS exploitation probability is 0.03% (10th percentile), though SSVC rates technical impact as total.
Server-side request forgery (SSRF) in Twenty CRM allows authenticated users to bypass IP filtering protections and access internal network resources, including cloud metadata endpoints containing IAM credentials. The vulnerability affects versions 1.18.0 and earlier through exploitation of IPv4-mapped IPv6 address normalization inconsistencies in Node.js URL parsing versus the isPrivateIp validation utility. Attackers with low-privilege authenticated access can exfiltrate sensitive credentials from cloud provider metadata services (169.254.169.254). No public exploit code or active exploitation (CISA KEV) confirmed at time of analysis, though the technical details in the GitHub security advisory provide a clear exploitation path.
OAuth authorization code forwarding to attacker-controlled hosts is enabled by an open redirect flaw in Twenty CRM through version 2.35.0, where the OAuthPropagatorController.propagateOAuthCallback endpoint accepts the state query parameter as an unvalidated redirect URL. Instances running with IS_MULTIWORKSPACE_ENABLED disabled are specifically vulnerable because this configuration bypasses the domain validation logic that would otherwise restrict redirect targets. No active exploitation has been confirmed in the CISA KEV catalog and no public proof-of-concept code was identified in the provided data, but the attack requires only a crafted link and passive victim interaction.
Stored cross-site scripting in Twenty CRM versions prior to 1.20.6 allows authenticated attackers to inject malicious JavaScript URIs into file block attachments via the BlockNote editor, executing arbitrary code in the browsers of users who click the malicious link. The vulnerability bypasses protocol validation in the FileBlock component and lacks server-side sanitization of block content; exploitation requires user interaction (clicking the attachment) but persistence is stored on the server, affecting all subsequent users who view the compromised document.
SQL injection in Twenty, an open-source CRM platform, lets a workspace administrator holding the DATA_MODEL permission inject arbitrary PostgreSQL into the DDL of the system searchVector TS_VECTOR field. By supplying a crafted settings.asExpression via PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, the attacker breaks out of the GENERATED ALWAYS AS (...) column clause and executes statements as the application database user, compromising all workspace data. It is fixed in 2.15.0, requires authenticated high-privilege access (CVSS 9.1, PR:H), and has no public exploit identified at time of analysis.
Cross-workspace data disclosure in Twenty CRM before 2.9.0 lets any authenticated user holding the AI settings flag (a workspace owner by default) read another tenant's AI agent chat history and trigger LLM evaluations against the victim's data on the same instance. By supplying a victim's agentId or turnId to the agentTurns query or evaluateAgentTurn mutation, an attacker retrieves raw chat text, tool calls, and tool outputs that belong to a different workspace. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Twenty CRM versions 1.7.7 through 1.16.7 allows authenticated users to execute arbitrary OS commands on the database server by chaining SQL injection in the REST API groupBy endpoint with PostgreSQL's COPY TO PROGRAM functionality. The unsanitized timeZone parameter is interpolated directly into raw SQL via JavaScript template literals, and exploitation succeeds whenever the application's Postgres role holds superuser privileges. Publicly available exploit code exists per SSVC, though EPSS scoring (0.15%) suggests exploitation activity has not yet become widespread.
Stored cross-site scripting in Twenty CRM versions 1.18.0 and earlier allows authenticated users to upload HTML/JavaScript files that the application then serves without security headers, enabling execution in the CRM's origin. Successful exploitation leads to session hijacking, account takeover, and theft of CRM data. No public exploit identified at time of analysis, and EPSS exploitation probability is 0.03% (10th percentile), though SSVC rates technical impact as total.
Server-side request forgery (SSRF) in Twenty CRM allows authenticated users to bypass IP filtering protections and access internal network resources, including cloud metadata endpoints containing IAM credentials. The vulnerability affects versions 1.18.0 and earlier through exploitation of IPv4-mapped IPv6 address normalization inconsistencies in Node.js URL parsing versus the isPrivateIp validation utility. Attackers with low-privilege authenticated access can exfiltrate sensitive credentials from cloud provider metadata services (169.254.169.254). No public exploit code or active exploitation (CISA KEV) confirmed at time of analysis, though the technical details in the GitHub security advisory provide a clear exploitation path.
OAuth authorization code forwarding to attacker-controlled hosts is enabled by an open redirect flaw in Twenty CRM through version 2.35.0, where the OAuthPropagatorController.propagateOAuthCallback endpoint accepts the state query parameter as an unvalidated redirect URL. Instances running with IS_MULTIWORKSPACE_ENABLED disabled are specifically vulnerable because this configuration bypasses the domain validation logic that would otherwise restrict redirect targets. No active exploitation has been confirmed in the CISA KEV catalog and no public proof-of-concept code was identified in the provided data, but the attack requires only a crafted link and passive victim interaction.
Stored cross-site scripting in Twenty CRM versions prior to 1.20.6 allows authenticated attackers to inject malicious JavaScript URIs into file block attachments via the BlockNote editor, executing arbitrary code in the browsers of users who click the malicious link. The vulnerability bypasses protocol validation in the FileBlock component and lacks server-side sanitization of block content; exploitation requires user interaction (clicking the attachment) but persistence is stored on the server, affecting all subsequent users who view the compromised document.