CVE-2026-46624

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46624", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-15T19:34:14.012Z", "datePublished": "2026-05-26T17:01:16.980Z", "dateUpdated": "2026-05-26T18:58:23.725Z"}, "containers": {"cna": {"title": "Twenty: SQL Injection via the timeZone field", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573"}], "affected": [{"vendor": "twentyhq", "product": "twenty", "versions": [{"version": ">= 1.7.7, <= 1.16.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T17:01:16.980Z"}, "descriptions": [{"lang": "en", "value": "Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint. The timeZone field within the group_by query parameter is directly interpolated into a raw SQL expression using JavaScript template literals without any parameterization, validation, or escaping. This affects engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts."}], "source": {"advisory": "GHSA-jgx4-6mr9-9573", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T18:58:00.606846Z", "id": "CVE-2026-46624", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T18:58:23.725Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46624", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-26T18:58:00.606846Z"}}}], "references": [{"url": "https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T18:57:35.635Z"}}], "cna": {"title": "Twenty: SQL Injection via the timeZone field", "source": {"advisory": "GHSA-jgx4-6mr9-9573", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "twentyhq", "product": "twenty", "versions": [{"status": "affected", "version": ">= 1.7.7, <= 1.16.7"}]}], "references": [{"url": "https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573", "name": "https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint. The timeZone field within the group_by query parameter is directly interpolated into a raw SQL expression using JavaScript template literals without any parameterization, validation, or escaping. This affects engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T17:01:16.980Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46624", "state": "PUBLISHED", "dateUpdated": "2026-05-26T18:58:23.725Z", "dateReserved": "2026-05-15T19:34:14.012Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-26T17:01:16.980Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "twenty", "vendor": "twentyhq", "versions": [{"status": "affected", "version": ">= 1.7.7, <= 1.16.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:twenty:twenty:*:*:*:*:*:*:*:*", "matchCriteriaId": "769B9D47-5FAF-4B6C-A813-62DB115A7ADB", "versionEndExcluding": "1.16.7", "versionStartIncluding": "1.7.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint. The timeZone field within the group_by query parameter is directly interpolated into a raw SQL expression using JavaScript template literals without any parameterization, validation, or escaping. This affects engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts."}, {"lang": "es", "value": "Twenty es un CRM de c\u00f3digo abierto. Desde la 1.7.7 hasta la 1.16.7, existe una vulnerabilidad cr\u00edtica de ejecuci\u00f3n remota de c\u00f3digo (RCE) en Twenty CRM a trav\u00e9s de un ataque encadenado de inyecci\u00f3n SQL y PostgreSQL COPY TO PROGRAM. Si el usuario de Postgres es un superusuario, cualquier usuario autenticado puede ejecutar comandos arbitrarios del sistema operativo en el servidor de la base de datos inyectando SQL a trav\u00e9s del par\u00e1metro timeZone no saneado en el endpoint groupBy de la API REST. El campo timeZone dentro del par\u00e1metro de consulta group_by se interpola directamente en una expresi\u00f3n SQL sin procesar utilizando literales de plantilla de JavaScript sin ninguna parametrizaci\u00f3n, validaci\u00f3n o escape. Esto afecta a engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts."}], "id": "CVE-2026-46624", "lastModified": "2026-07-24T11:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46624", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T18:58:00.606846Z", "version": "2.0.3"}}]}, "published": "2026-05-26T18:16:52.400", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.7.7,1.16.7]"}}], "enrichment": {"confidence": 93.0, "confidence_source": "matching", "scores": [{"score": 93.0, "source": "matching"}]}, "original": {"product": "twenty", "source": "cna", "vendor": "twentyhq"}, "product": "twenty", "vendor": "twenty"}], "created": "2026-05-26T19:45:06.476392+00:00", "updated": "2026-05-27T09:30:26.796004+00:00", "vendors": ["twenty", "twenty$PRODUCT$twenty"]}