CVE-2026-46637

medium

Description

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. This issue is fixed in version 3.26.0.

References

https://github.com/twigphp/Twig/security/advisories/GHSA-jv8m-2544-3pg3

https://github.com/twigphp/Twig/releases/tag/v3.26.0

https://github.com/twigphp/Twig/commit/e36489d3521ecbfc08bdcc61294302557035f14a

https://github.com/twigphp/Twig/commit/84982072c79a7417b0d158a401d91344f3658299

Details

Source: Mitre, NVD

Published: 2026-07-14

Updated: 2026-07-14

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 5.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Severity: Medium

EPSS

EPSS: 0.0006