CVE-2026-46637: Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all]…

PriorityP427medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.30%

23.2th percentile

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. This issue is fixed in version 3.26.0.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
symfony	twig	< 3.26.0	3.26.0
twig	cssinliner-extra	< 3.26.0	3.26.0
twig	cssinliner-extra	>= 0 < 3.26.0	3.26.0
twig	markdown-extra	< 3.26.0	3.26.0
twig	markdown-extra	>= 0 < 3.26.0	3.26.0
twigphp	twig	< 3.26.0	3.26.0

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.