Twine 2 Story Import Executes Arbitrary Code via XSS

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file, executing code as the user.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Twine 2 is a popular open-source tool for creating interactive fiction and narrative games, used by writers, developers, and educators worldwide. CVE-2026-105220 exploits a critical flaw in the importStories() function where malicious markup embedded in story files executes without sanitization in the editor window. An attacker can craft a weaponized .twee or story file that, when imported by a victim, triggers JavaScript execution. This leads to a privilege escalation chain: the embedded script leverages the twineElectron IPC bridge to write arbitrary .bat files to the user's system and execute them with the same privileges as the Twine application. This vulnerability affects all versions through 2.12.0 and represents a complete compromise vector for users who import untrusted story files—a common practice in collaborative creative communities.

Casky's 323 mapped skills detect this attack through two critical MITRE ATT&CK techniques: TA0001 (Initial Access) identifies the weaponized story file delivery and social engineering tactics that convince users to import malicious content, while TA0043 (Reconnaissance) surfaces the attacker's need to understand Twine's IPC bridge architecture. Using Claude AI with extended reasoning, practitioners will see findings that connect the XSS injection point (CWE-79) to the IPC bridge abuse, flagging the suspicious twineElectron.openWithScratchFile calls and .bat file generation patterns. The skill analysis reveals the complete kill chain: file import → script execution → IPC exploitation → arbitrary code execution, enabling detection of both known exploit attempts and novel variations that follow this behavioral pattern.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-105220.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-105220

Casky has 323 skills that investigate the attack patterns behind CVE-2026-105220. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn