CVE-2026-35451: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in twentyhq twenty
Twenty is an open source CRM. Prior to 1.20.6, a Stored Cross-Site Scripting (XSS) vulnerability exists in the BlockNote editor component. Due to a lack of protocol validation in the FileBlock component and insufficient server-side inspection of block content, an attacker can inject a javascript: URI into the url property of a file block. This allows the execution of arbitrary JavaScript when a user clicks on the malicious file attachment. This vulnerability is fixed in 1.20.6.
AI Analysis
Technical Summary
CVE-2026-35451 is a stored XSS vulnerability in twentyhq's twenty CRM software affecting versions before 1.20.6. The vulnerability is due to improper neutralization of input in the BlockNote editor's FileBlock component, which lacks protocol validation and adequate server-side inspection of block content. An attacker can inject a javascript: URI into the url property of a file block, causing arbitrary JavaScript execution upon user interaction with the malicious file attachment. This vulnerability is addressed in version 1.20.6.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when they click on a malicious file attachment. This can lead to potential compromise of user session data or other client-side impacts. The CVSS score of 5.7 reflects a medium severity with high confidentiality impact but no integrity or availability impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade to twenty version 1.20.6 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in this version, applying this official fix is the recommended remediation. No additional mitigations are specified or required.
CVE-2026-35451: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in twentyhq twenty
Description
Twenty is an open source CRM. Prior to 1.20.6, a Stored Cross-Site Scripting (XSS) vulnerability exists in the BlockNote editor component. Due to a lack of protocol validation in the FileBlock component and insufficient server-side inspection of block content, an attacker can inject a javascript: URI into the url property of a file block. This allows the execution of arbitrary JavaScript when a user clicks on the malicious file attachment. This vulnerability is fixed in 1.20.6.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-35451 is a stored XSS vulnerability in twentyhq's twenty CRM software affecting versions before 1.20.6. The vulnerability is due to improper neutralization of input in the BlockNote editor's FileBlock component, which lacks protocol validation and adequate server-side inspection of block content. An attacker can inject a javascript: URI into the url property of a file block, causing arbitrary JavaScript execution upon user interaction with the malicious file attachment. This vulnerability is addressed in version 1.20.6.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when they click on a malicious file attachment. This can lead to potential compromise of user session data or other client-side impacts. The CVSS score of 5.7 reflects a medium severity with high confidentiality impact but no integrity or availability impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade to twenty version 1.20.6 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in this version, applying this official fix is the recommended remediation. No additional mitigations are specified or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-02T19:25:52.192Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e7a9cf19fe3cd2cde6d344
Added to database: 4/21/2026, 4:46:07 PM
Last enriched: 4/21/2026, 5:01:40 PM
Last updated: 4/21/2026, 5:56:14 PM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.