Twenty contains a Stored Cross‑Site Scripting vulnerability in the BlockNote editor. Because the FileBlock component does not validate the protocol and the server lacks adequate inspection, an attacker can embed a javascript: URI into the url property of a file block. When a user later clicks the malicious attachment, arbitrary JavaScript is executed in the victim’s browser, enabling code execution, session hijacking, or other client‑side attacks.

The affected product is the open source CRM Twenty, produced by TwentyHQ. The vulnerability exists in any installation running a version earlier than 1.20.6; versions 1.20.6 and newer contain the remedy.

The CVSS score of 5.7 indicates medium severity, and the lack of an EPSS value means the exploitation probability is not quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to store a malicious file block, which likely requires some level of access to create or modify content, and a victim must click the injected link. The resulting code execution can compromise confidentiality and integrity of the victim’s session.