CVE-2026-46637

Description

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. This issue is fixed in version 3.26.0.

PUBLISHED Reserved 2026-05-15 | Published 2026-07-14 | Updated 2026-07-14 | Assigner GitHub_M

Problem types

CWE-116: Improper Encoding or Escaping of Output

Product status

References

github.com/...p/Twig/security/advisories/GHSA-jv8m-2544-3pg3

github.com/...ommit/84982072c79a7417b0d158a401d91344f3658299

github.com/...ommit/e36489d3521ecbfc08bdcc61294302557035f14a

github.com/twigphp/Twig/releases/tag/v3.26.0

cve.org (CVE-2026-46637)

nvd.nist.gov (CVE-2026-46637)

Download JSON