medium5.7
CVE-2026-35451
Twenty is an open source CRM.
Impact
Twenty is an open source CRM. Prior to 1.20.6, a Stored Cross-Site Scripting (XSS) vulnerability exists in the BlockNote editor component. Due to a lack of protocol validation in the FileBlock component and insufficient server-side inspection of block content, an attacker can inject a javascript: URI into the url property of a file block. This allows the execution of arbitrary JavaScript when a user clicks on the malicious file attachment. This vulnerability is fixed in 1.20.6.
Affected products
| Product | Affected versions |
|---|---|
| Twenty Is An Open Source CRM. | before 1.20.6 |
Versions were read from the advisory text. No structured product data has been published for this record yet.