关键信息总结 Overview Product: Twenty CRM Vulnerability: Remote Code Execution (RCE) via Serverless Workflow Functions Severity: Critical Affected Component: Workflow Automation (Code - Serverless Function) Tested Version: v1.15.0 Vulnerability Details The vulnerability allows authenticated users to execute arbitrary Node.js code on the host server due to a lack of sandboxing. Proof of Concept (PoC) Steps include logging in, navigating to settings, creating a workflow, adding a code step, and running the workflow to execute commands and read sensitive files. Impact Confidentiality: Database and file system data can be read. Integrity: Application code can be modified, and malware can be injected. Availability: The server can be shut down or resources consumed. Remediation Implement sandboxing, restrict access to sensitive Node.js modules, and scrub environment variables.