Vulnerability Description
Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. This issue is fixed in version 3.26.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Symfony | Twig | < 3.26.0 |
Related Weaknesses (CWE)
References
- https://github.com/twigphp/Twig/commit/84982072c79a7417b0d158a401d91344f3658299Patch
- https://github.com/twigphp/Twig/commit/e36489d3521ecbfc08bdcc61294302557035f14aPatch
- https://github.com/twigphp/Twig/releases/tag/v3.26.0Release Notes
- https://github.com/twigphp/Twig/security/advisories/GHSA-jv8m-2544-3pg3Vendor Advisory
FAQ
What is CVE-2026-46637?
CVE-2026-46637 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML ou...
How severe is CVE-2026-46637?
CVE-2026-46637 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-46637?
Check the references section above for vendor advisories and patch information. Affected products include: Symfony Twig.