CVE-2026-46637

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. This issue is fixed in version 3.26.0.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/twigphp/Twig/commit/84982072c79a7417b0d158a401d91344f3658299	Patch
https://github.com/twigphp/Twig/commit/e36489d3521ecbfc08bdcc61294302557035f14a	Patch
https://github.com/twigphp/Twig/releases/tag/v3.26.0	Release Notes
https://github.com/twigphp/Twig/security/advisories/GHSA-jv8m-2544-3pg3	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*

History

15 Jul 2026, 20:18

Type	Values Removed	Values Added
First Time		Symfony Symfony twig
CWE		CWE-79
CPE		cpe:2.3:a:symfony:twig::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.4
References	~~() https://github.com/twigphp/Twig/commit/84982072c79a7417b0d158a401d91344f3658299 -~~	() https://github.com/twigphp/Twig/commit/84982072c79a7417b0d158a401d91344f3658299 - Patch
References	~~() https://github.com/twigphp/Twig/commit/e36489d3521ecbfc08bdcc61294302557035f14a -~~	() https://github.com/twigphp/Twig/commit/e36489d3521ecbfc08bdcc61294302557035f14a - Patch
References	~~() https://github.com/twigphp/Twig/releases/tag/v3.26.0 -~~	() https://github.com/twigphp/Twig/releases/tag/v3.26.0 - Release Notes
References	~~() https://github.com/twigphp/Twig/security/advisories/GHSA-jv8m-2544-3pg3 -~~	() https://github.com/twigphp/Twig/security/advisories/GHSA-jv8m-2544-3pg3 - Vendor Advisory

14 Jul 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-14 22:16

Updated : 2026-07-16 16:19

NVD link : CVE-2026-46637

Mitre link : CVE-2026-46637

CVE.ORG link : CVE-2026-46637

JSON object : View

Products Affected

symfony

twig

CWE

CWE-116

Improper Encoding or Escaping of Output

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-46637", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46637", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T15:05:39.751817Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "twigphp", "product": "Twig", "versions": [{"status": "affected", "version": "< 3.26.0"}]}, {"vendor": "twig", "product": "cssinliner-extra", "versions": [{"status": "affected", "version": "< 3.26.0"}]}, {"vendor": "twig", "product": "markdown-extra", "versions": [{"status": "affected", "version": "< 3.26.0"}]}]}], "published": "2026-07-14T22:16:56.410", "references": [{"url": "https://github.com/twigphp/Twig/commit/84982072c79a7417b0d158a401d91344f3658299", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/twigphp/Twig/commit/e36489d3521ecbfc08bdcc61294302557035f14a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/twigphp/Twig/releases/tag/v3.26.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/twigphp/Twig/security/advisories/GHSA-jv8m-2544-3pg3", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-116"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. This issue is fixed in version 3.26.0."}], "lastModified": "2026-07-16T16:19:08.693", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "797B6432-E13E-450D-BF3C-8CEDA7D265F4", "versionEndExcluding": "3.26.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}