VulnerabilityAnalyzed

CVE-2026-46637

Twig is a template language for PHP.

MEDIUM 5.1EPSS 0.30%

Does this matter?

Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.

Description

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. This issue is fixed in version 3.26.0.

CVSS 4.0: 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.30% probability · 23th percentile
CISA KEV: Not listed
Weakness: CWE-116, CWE-79
Affected: symfony/twig
Source: security-advisories@github.com

References

https://github.com/twigphp/Twig/commit/84982072c79a7417b0d158a401d91344f3658299Patch
https://github.com/twigphp/Twig/commit/e36489d3521ecbfc08bdcc61294302557035f14aPatch
https://github.com/twigphp/Twig/releases/tag/v3.26.0Release Notes
https://github.com/twigphp/Twig/security/advisories/GHSA-jv8m-2544-3pg3Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.