Sandbox Information Disclosure in Twig by Symfony

CVE-2019-9942

What is CVE-2019-9942?

A sandbox information disclosure vulnerability was identified in the Twig templating engine, which permits unauthorized access to object data under specific conditions. This occurs when the __toString() method is invoked on an object, circumventing existing security policies. The issue affects versions of Twig prior to 1.38.0 for the 1.x series and 2.7.0 for the 2.x series. It is crucial for developers using these versions to implement the necessary updates to safeguard against potential data exposure.

References