Advisories for packages from twig

Listing reported advisories for packages from twig sorted by their report date.

Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` and `in`/`not in` operators
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
Sandbox `__toString()` policy bypass via dynamic mapping keys
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
GitHub

twig/twig

>= 3.15.0, < 3.26.0

2026-05-21 21:31:09
Twig: Sandbox property and method bypass via object-destructuring assignment
GitHub

twig/twig

>= 3.24.0, < 3.26.0

2026-05-21 21:30:50
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
GitHub

twig/twig

< 3.26.0

2026-05-21 21:28:28
Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
GitHub

twig/markdown-extra

< 3.26.0

2026-05-21 21:27:21
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
GitHub

twig/twig

< 3.26.0

2026-05-21 21:25:56
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
GitHub

twig/twig

>= 3.9.0, < 3.26.0

2026-05-21 21:25:13
Twig: PHP code injection via `{% use %}` template name
GitHub

twig/twig

< 3.26.0

2026-05-21 21:24:54
twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments
GitHub

twig/intl-extra

< 3.26.0

2026-05-21 21:23:53
Twig: The `spaceless` filter implicitly marks its output as safe
GitHub

twig/twig

< 3.26.0

2026-05-21 21:21:37
Possible sandbox bypass when using a source policy
FriendsOfPHP

twig/twig

>=3.9.0, <3.26.0 · >=2.16.0, <3.0.0

2026-05-20 08:00:00
Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-20 08:00:00
XSS in profiler HtmlDumper via unescaped template and profile names
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0

2026-05-20 08:00:00
Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
FriendsOfPHP

twig/twig

>=3.15.0, <3.26.0

2026-05-20 08:00:00
Sandbox property and method bypass via object-destructuring assignment
FriendsOfPHP

twig/twig

>=3.24.0, <3.26.0

2026-05-20 08:00:00
`{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-20 08:00:00
Sandbox property allowlist bypass via the `column` filter (array_column on objects)
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-20 08:00:00
`template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
FriendsOfPHP

twig/twig

>=3.9.0, <3.26.0

2026-05-20 08:00:00
PHP code injection via `{% use %}` template name
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-20 08:00:00
The `spaceless` filter implicitly marks its output as safe
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-20 08:00:00
HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
FriendsOfPHP

twig/cssinliner-extra

>=3.0.0, <3.26.0 · >=2.12.0, <3.0.0

2026-05-20 08:00:00
Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
FriendsOfPHP

twig/intl-extra

>=3.0.0, <3.26.0 · >=2.12.0, <3.0.0

2026-05-20 08:00:00
HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
FriendsOfPHP

twig/markdown-extra

>=3.0.0, <3.26.0 · >=2.12.0, <3.0.0

2026-05-20 08:00:00
Sandbox does not protect against resource exhaustion
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-20 08:00:00
Twig security issue where escaping was missing when using null coalesce operator
GitHub

twig/twig

>= 3.16.0, < 3.19.0

2025-01-29 18:41:46
Missing output escaping for the null coalesce operator
FriendsOfPHP

twig/twig

>=3.16.0, <3.19.0

2025-01-29 06:52:00
Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled
GitHub

twig/twig

>= 3.12.0, < 3.14.1 · >= 1.0.0, < 3.11.2 · >= 3.12, < 3.14.1 · < 3.11.2

2024-11-12 19:43:03
Twig has unguarded calls to `__toString()` when nesting an object into an array
GitHub

twig/twig

>= 3.12.0, < 3.14.1 · >= 1.0.0, < 3.11.2 · >= 3.12, < 3.14.1 · < 3.11.2

2024-11-12 19:42:26
Unguarded calls to __isset() and to array-accesses when the sandbox is enabled
FriendsOfPHP

twig/twig

>=3.12.0, <3.14.1 · >=3.0.0, <3.11.2 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2024-11-06 08:00:00
Unguarded calls to __toString() when nesting an object into an array
FriendsOfPHP

twig/twig

>=3.12.0, <3.14.1 · >=3.0.0, <3.11.2 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2024-11-06 08:00:00
Twig has a possible sandbox bypass
GitHub

twig/twig

>= 3.12.0, < 3.14.0 · >= 3.0.0, < 3.14.0 · >= 3.0.0, < 3.11.1 · >= 2.0.0, < 2.16.1 · >= 1.0.0, < 1.44.8

2024-09-10 17:12:23
Possible sandbox bypass
FriendsOfPHP

twig/twig

>=3.12.0, <3.14.0 · >=3.0.0, <3.11.0 · >=2.0.0, <2.16.0 · >=1.0.0, <1.44.7

2024-09-09 08:51:06
Twig Path Traversal vulnerability in the filesystem loader
GitHub

twig/twig

>= 1.0.0, < 1.12.3

2024-05-30 13:42:52
Twig remote code execution in templates
GitHub

twig/twig

< 1.20.0

2024-05-30 12:39:44
Twig Sandbox Information Disclosure
GitHub

twig/twig

>= 2.0.0, < 2.7.0 · < 1.38.0

2023-09-21 19:49:04
Twig may load a template outside a configured directory when using the filesystem loader
GitHub

twig/twig

>= 2.0.0, < 2.15.3 · >= 1.0.0, < 1.44.7 · >= 3.0.0, < 3.4.3

2022-09-30 05:29:37
Possibility to load a template outside a configured directory when using the filesystem loader
FriendsOfPHP

twig/twig

>=2.0.0, <2.15.3 · >=1.0.0, <1.44.7 · >=3.0.0, <3.4.3

2022-09-28 10:36:08
Code injection in Twig
GitHub

twig/twig

>= 2.0.0, < 2.14.11 · >= 3.0.0, < 3.3.8

2022-02-16 22:06:43
Disallow non closures in the sort filter
FriendsOfPHP

twig/twig

>=2.0.0, <2.14.11 · >=3.0.0, <3.3.8

2022-02-04 06:54:44
Sandbox Information Disclosure
FriendsOfPHP

twig/twig

>=2.0.0, <2.7.0 · <1.38.0

2019-03-12 12:36:16
Remote code execution in templates
FriendsOfPHP

twig/twig

<1.20.0

2015-08-12 15:53:50
Vulnerability in the filesystem loader
FriendsOfPHP

twig/twig

>=1.0.0, <1.12.3

2013-04-08 13:16:10