Twig security advisories
Latest release 3.30.0 twig/twig
No open advisories.
Check your version
Type the Twig version you run to see which advisories affect it.
All Twig advisories
28 advisories, newest first.
-
high Symfony · · Reviewed
Twig Sandbox: Allow-List Bypass When Sandbox State Changes
Lets an untrusted template use forbidden filters, tags and functions when one Twig environment renders both sandboxed and normal templates.
No fixed release listed yet
-
medium Symfony · · Reviewed
Twig Sandbox: column Filter Reads Blocked Properties Under a Source Policy
Lets an untrusted template read blocked object properties with the column filter when the sandbox is set by a source policy.
Fixed in 3.27.0
-
low Symfony · · Reviewed
Twig Sandbox: Deprecated Helper Functions Skip Sandbox Checks
Lets sandboxed templates get around callable checks through deprecated Twig helper functions still used by older third-party code.
Fixed in 3.27.0
-
high Symfony · · Reviewed
Twig Sandbox: Allow-List Bypass When Sandbox State Changes
Lets an untrusted template use forbidden filters, tags and functions when one Twig environment renders both sandboxed and normal templates.
Fixed in 3.27.0
-
medium Symfony · · Reviewed
Twig Sandbox: __toString() Bypass via Dynamic Mapping Keys
Lets an untrusted template call __toString() on objects the sandbox policy blocks, a leftover gap from the GHSA-pr2w-4gpj-cpq4 fix.
Fixed in 3.27.0
-
medium Symfony · · Reviewed
Twig Sandbox: __toString() Bypass via join, replace and in
Lets an untrusted template call __toString() on objects the sandbox policy blocks, a leftover gap from the GHSA-pr2w-4gpj-cpq4 fix.
Fixed in 3.27.0
-
low Symfony · · Reviewed
Twig Intl Extra: Formatter Cache Can Grow Without Limit
Lets a template use up memory outside memory_limit by passing many distinct formats to Twig's intl filters, mainly on long-running workers.
Fixed in 3.26.0
-
low Symfony · · Reviewed
Twig Extras: Some Filters Skip Escaping in Every Context
Can allow cross-site scripting when output from filters like html_to_markdown or markdown_to_html is used in templates without escaping.
Fixed in 3.26.0
-
medium Symfony · · Reviewed
Twig Sandbox: template_from_string Escapes a Source Policy Sandbox
Lets a sandboxed template run any tag, filter or function when the sandbox is set by a source policy and template_from_string is allowed.
Fixed in 3.26.0
-
high Symfony · · Reviewed
Twig Sandbox: Several Ways to Call Blocked __toString() Methods
Lets an untrusted template call __toString() on objects the sandbox policy blocks, through operators and expressions the sandbox didn't check.
Fixed in 3.26.0
-
high Symfony · · Reviewed
Twig Sandbox: Callback Filters Accept Any PHP Callable Under a Source Policy
Lets a sandboxed template pass any PHP callable to sort, filter, map or reduce when the sandbox is set by a source policy.
Fixed in 3.26.0 · 1 older release
-
medium Symfony · · Reviewed
Twig Sandbox: {% sandbox %} Include Skips Checks on Cached Templates
Lets an included template use any tag, filter or function if it was loaded outside the sandbox first, through the {% sandbox %} tag.
Fixed in 3.26.0
-
low Symfony · · Reviewed
Twig Sandbox: column Filter Reads Blocked Object Properties
Lets an untrusted template read object properties the sandbox policy blocks, when the column filter is allowed.
Fixed in 3.26.0
-
low Symfony · · Reviewed
Twig Sandbox: Untrusted Templates Can Use Unlimited CPU and Memory
Allows a sandboxed Twig template to use as much CPU, memory and time as it likes; Twig now documents limiting this at the process level.
Fixed in 3.26.0
-
high Symfony · · Reviewed
Twig Sandbox: Object Destructuring Skips Property and Method Checks
Lets a sandboxed template read any public property or call any public getter through object destructuring, in Twig 3.24 and 3.25.
Fixed in 3.26.0
-
low Symfony · · Reviewed
Twig Profiler: Cross-Site Scripting in HtmlDumper Output
Lets attacker-controlled template names inject HTML into Twig profiler dumps rendered with HtmlDumper.
Fixed in 3.26.0
-
critical Symfony · · Reviewed
Twig: Code Execution Through a Crafted {% use %} Template Name
Lets anyone who can write a template, even a sandboxed one, run PHP code on the server through the {% use %} tag.
Fixed in 3.26.0
-
low Symfony · · Reviewed
Twig: spaceless Filter Output Skips Autoescaping
Can allow cross-site scripting when templates apply the deprecated spaceless filter to user input with autoescape on.
Fixed in 3.26.0
-
high Symfony · · Reviewed
Twig: Code Execution Through Dynamic Macro References on _self
Lets anyone who can write a template run PHP code on the server, bypassing even a strict sandbox, in Twig 3.15 to 3.25.
Fixed in 3.26.0
-
medium Symfony · · Reviewed
Twig: Null Coalesce Operator Skips Output Escaping
Leaves the left side of a ?? expression unescaped in Twig templates, so user input there can carry HTML or script into the page.
Fixed in 3.19.0
-
low Symfony · · Reviewed
Twig Sandbox: __toString() Runs on Objects in Arrays Without a Check
Lets untrusted templates call __toString() on objects the sandbox policy blocks, when the object sits in an array or an argument list.
Fixed in 3.14.1 · 1 older release
-
low Symfony · · Reviewed
Twig Sandbox: Array-Like Objects Skip the Security Policy
Lets untrusted templates read properties of ArrayAccess objects that the sandbox policy should block, in apps that run user templates in Twig's sandbox.
Fixed in 3.14.1 · 1 older release
-
medium Symfony ·
Fixed in 3.14.0 and 2.16.0 · 2 older releases
-
high Symfony ·
Possibility to load a template outside a configured directory when using the filesystem loader
Fixed in 3.4.3 and 2.15.3 · 1 older release
-
high Symfony ·
Disallow non closures in the sort filter
Fixed in 3.3.8 and 2.14.11
-
low Symfony ·
Sandbox Information Disclosure
Fixed in 2.7.0 and 1.38.0
-
high Symfony ·
Remote code execution in templates
Fixed in 1.20.0
-
medium Symfony ·
Vulnerability in the filesystem loader
Fixed in 1.12.3