Twig

This hub aggregates every CVE we track for Twig, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Twig.

• CVE-2026-48807Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters9.1Jul 14, 2026
• CVE-2026-48806Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys9.1Jul 14, 2026
• CVE-2026-48808Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`7.5Jul 14, 2026
• CVE-2026-48805Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`9.1Jul 14, 2026
• CVE-2026-49981Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`8.2Jul 14, 2026
• CVE-2026-46637Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`5.4Jul 14, 2026
• CVE-2026-46638Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)8.1Jul 14, 2026
• CVE-2026-46640Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation8.8Jul 14, 2026
• CVE-2026-46629Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments6.5Jul 14, 2026
• CVE-2026-47730Twig: XSS in profiler HtmlDumper via unescaped template and profile names5.4Jul 14, 2026
• CVE-2026-46628Twig: The `spaceless` filter implicitly marks its output as safe5.4Jul 14, 2026
• CVE-2026-46634Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name9.8Jul 14, 2026
• CVE-2026-46627Twig: Sandbox resource exhaustion via unbounded `for` / `range()`6.5Jul 14, 2026
• CVE-2026-46633Twig: PHP code injection via `{% use %}` template name9.8Jul 14, 2026
• CVE-2026-46639Twig: Sandbox property and method bypass via object-destructuring assignment6.5Jul 14, 2026