TI-2026-67695 CVE-2026-105220 · GHSA-qx8m-f384-xrj3Cross-site scripting in Twine desktop lets story files run codePriority HIGH 72Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window.CVSS 4.0HIGH 8.5· Local · No auth · User interaction · EPSS 0.00215 · Published 2026-10-04 · No fix listed CWE-79