Twig v3.26.0 Security Update: Sandbox Bypass and Injection Fixes

Twig v3.26.0 Security Update Summary Vulnerability Overview Twig template engine version v3.26.0 fixes multiple security vulnerabilities, primarily involving sandbox escapes, resource exhaustion, code injection, and XSS attacks. Impact Scope Twig Template Engine (PHP template library) Projects using the Sandbox feature Projects using , , , , , , and other filters/functions Projects using , , , tags Projects using HTML output filters (such as HTML filters in ) Remediation 1. Resource Exhaustion Protection: Documentation clarifies that the sandbox does not protect against resource exhaustion attacks (CVE-2026-46627) 2. Input Pre-escaping: HTML input for the filter is pre-escaped (CVE-2026-46628) 3. Template String Vulnerabilities: Documentation highlights vulnerabilities of in sandbox environments (CVE-2026-46634) 4. Sandbox Escape Fixes: - Fixed sandbox escape in the filter (CVE-2026-46635) - Fixed (CVE-2026-47732) - Fixed sandbox escape in for template and profile config filenames (CVE-2026-47730) - Fixed code injection via preloaded templates through or (CVE-2026-46640) - Fixed sandbox escape in the tag (CVE-2026-46638) - Fixed PHP code injection through template names (CVE-2026-46633) - Fixed unbounded memoization in / (CVE-2026-46629) - Fixed XSS and pre-escaped input for HTML output filters (CVE-2026-46637) - Fixed sandbox escape in object destructuring assignment (CVE-2026-46639) - Fixed source policy sandbox escape from to (CVE-2026-24425) Contributors fabpot nicolas-grekas alexandre-daubois Version Information Version: v3.26.0 Release Date: 2 days ago Commits: 1 commit SHA: 1fcae48 Resources Source code (zip) Source code (tar.gz)

Goal Reached Thanks to every supporter — we hit 100%!

Twig v3.26.0 Security Update: Sandbox Bypass and Injection Fixes

More from this source