Security Flaw in Twig PHP Template Engine Affects Output Safety

CVE-2026-46637

What is CVE-2026-46637?

Prior to version 3.26.0, Twig, a popular template engine for PHP, registered several filters in twig/markdown-extra and twig/cssinliner-extra as safe, treating unescaped output as secure in contexts such as HTML, JavaScript, and CSS. This oversight can potentially lead to exploitation through Cross-Site Scripting (XSS) attacks if untrusted data is processed. The issue has been addressed in version 3.26.0, ensuring that proper output escaping protocols are adhered to, thereby enhancing application security.

References