CVE-2026-46637

EUVD-2026-44509
Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. This issue is fixed in version 3.26.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Debian logo
Debian Releases
Debian Product
Codename
php-twig
bookworm
3.5.1-1+deb12u3
fixed
bookworm (security)
3.5.1-1+deb12u3
fixed
bullseye
vulnerable
bullseye (security)
vulnerable
forky
3.27.1-1
fixed
sid
3.27.1-1
fixed
trixie
3.27.0-0+deb13u1
fixed
trixie (security)
3.27.0-0+deb13u1
fixed
Common Weakness Enumeration
References
https://github.com/twigphp/Twig/commit/84982072c79a7417b0d158a401d91344f3658299
https://github.com/twigphp/Twig/commit/e36489d3521ecbfc08bdcc61294302557035f14a
https://github.com/twigphp/Twig/releases/tag/v3.26.0
https://github.com/twigphp/Twig/security/advisories/GHSA-jv8m-2544-3pg3