Vulnerability Description
Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint. The timeZone field within the group_by query parameter is directly interpolated into a raw SQL expression using JavaScript template literals without any parameterization, validation, or escaping. This affects engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Twenty | Twenty | >= 1.7.7, < 1.16.7 |
Related Weaknesses (CWE)
References
- https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573ExploitVendor Advisory
- https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573ExploitVendor Advisory
FAQ
What is CVE-2026-46624?
CVE-2026-46624 is a vulnerability with a CVSS score of 9.9 (CRITICAL). Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If...
How severe is CVE-2026-46624?
CVE-2026-46624 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-46624?
Check the references section above for vendor advisories and patch information. Affected products include: Twenty Twenty.