A critical Remote Code Execution vulnerability exists in the Twenty CRM platform from versions 1.7.7 through 1.16.7. An authenticated user can exploit a chained SQL injection and PostgreSQL COPY TO PROGRAM attack by injecting malicious content into the unsanitized timeZone parameter of the groupBy endpoint. The raw SQL expression is assembled using JavaScript template literals, allowing direct SQL execution that, if the database user is a super user, translates into arbitrary OS command execution on the database server. The impact is full control over the operating system and all data stored therein, representing a catastrophic breach.

The affected systems are installations of the Twenty open‑source CRM provided by twentyhq, specifically any version in the 1.7.7 through 1.16.7 range. The vulnerability lies in the file get-group-by-expression.util.ts located under engine/api/graphql/graphql-query-runner/group-by/resolvers/utils. No other products or vendors are listed as impacted.

The CVSS score of 9.9 denotes a critical severity. The EPSS score is not available, so the current exploitation probability is unknown; however, because the attack requires only authentication and the presence of a super‑user database role, the risk is high. The vulnerability is not in the CISA KEV catalog. An attacker would authenticate to the CRM, submit a crafted timeZone value in the groupBy request, and cause the database to run arbitrary shell commands via COPY TO PROGRAM. Success depends on the database user having super‑user privileges, but many deployments configure the CRM with such privileges, amplifying the potential impact.