An insecure implementation in the local.driver.ts module of Twenty CRM allows a remote attacker to inject and execute arbitrary code. The vulnerability stems from unauthenticated code evaluation exposed through this module, which is classified as Code Injection (CWE-94). An attacker who can reach the CRM instance can exploit the flaw to run any system command, compromising confidentiality, integrity, and availability of the entire server.

Twenty CRM versions 1.15.0 and earlier are affected. The vulnerability exists in the local.driver.ts file and is present in all releases that have not been patched beyond version 1.15.0.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. EPSS indicates a probability of exploitation below 1%, suggesting that, at present, exploitation attempts are unlikely but the risk remains high due to the lack of a public fix. The vulnerability is not listed in the CISA known exploited vulnerabilities catalog as of this assessment. Exploitation requires sending a crafted request to the exposed local.driver.ts endpoint, which is reachable from any machine that can access the CRM instance.