VulnerabilityDeferred

CVE-2025-24374

When using the ?? operator, output escaping was missing for the expression on the left side of the operator.

MEDIUM 4.3EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS: 0.29% probability · 21th percentile
CISA KEV: Not listed
Weakness: CWE-74
Source: security-advisories@github.com

References

https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.