Twinejs
Monthly
Code execution as the logged-in user results when someone running the Twine 2 desktop (Electron) application on version 2.12.0 or earlier imports a crafted story file. The importStories() routine renders untrusted markup from the imported file inside the editor window, and a script smuggled in that markup can reach the twineElectron openWithScratchFile IPC bridge to write and then open a .bat file, yielding arbitrary code execution in the user's context. No public exploit code has been identified at time of analysis, and although no authentication is required (CVSS vector PR:N), exploitation depends on the victim actively importing the attacker's file, so delivery is a social-engineering problem; the CVSS 4.0 base score is 8.5 (High) with high confidentiality, integrity, and availability impact on the local host only.
Code execution as the logged-in user results when someone running the Twine 2 desktop (Electron) application on version 2.12.0 or earlier imports a crafted story file. The importStories() routine renders untrusted markup from the imported file inside the editor window, and a script smuggled in that markup can reach the twineElectron openWithScratchFile IPC bridge to write and then open a .bat file, yielding arbitrary code execution in the user's context. No public exploit code has been identified at time of analysis, and although no authentication is required (CVSS vector PR:N), exploitation depends on the victim actively importing the attacker's file, so delivery is a social-engineering problem; the CVSS 4.0 base score is 8.5 (High) with high confidentiality, integrity, and availability impact on the local host only.