PT-2026-43352 · Unknown · Twenty Crm

Lagathos · Published 2026-05-26 · Updated 2026-05-27 · CVE-2026-46624

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Twenty CRM versions 1.7.7 through 1.16.7

Description A Remote Code Execution (RCE) issue exists via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If the Postgres user is a superuser, any authenticated user can execute arbitrary OS commands on the database server. This occurs because the timeZone parameter in the REST API 'groupBy' endpoint is directly interpolated into a raw SQL expression using JavaScript template literals without parameterization, validation, or escaping. This affects the get-group-by-expression.util.ts function.

Recommendations For versions 1.7.7 through 1.16.7, update the software to a version where the timeZone parameter is properly sanitized. As a temporary workaround, restrict the database user permissions to ensure the Postgres user is not a superuser to prevent the execution of OS commands.

Exploit

Fix

RCE

OS Command Injection

SQL injection

Weakness Enumeration

CWE-78

CWE-89

Related Identifiers

CVE-2026-46624

Affected Products

Twenty Crm

References · 6

• 🔥 https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46624 · Security Note
• https://twitter.com/infoflowcloud/status/2059337703439601918 · Twitter Post
• https://twitter.com/dailycve/status/2059687711322079416 · Twitter Post
• https://twitter.com/CVEnew/status/2059337197992443933 · Twitter Post
• https://t.me/cveNotify/164856 · Telegram Post