CVE-2026-46637

5.1 mediumEPSS 0.3%

Medium (5.1) in symfony twig. EPSS 0.3% chance of exploitation in the next 30 days.

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. This issue is fixed in version 3.26.0.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-116
Published: 2026-07-14
Modified: 2026-07-16
Record from: the NVD, synced 2026-10-19

Affected

symfony:twig

References

https://github.com/twigphp/Twig/commit/84982072c79a7417b0d158a401d91344f3658299
https://github.com/twigphp/Twig/commit/e36489d3521ecbfc08bdcc61294302557035f14a
https://github.com/twigphp/Twig/releases/tag/v3.26.0
https://github.com/twigphp/Twig/security/advisories/GHSA-jv8m-2544-3pg3

Check your stack JSON