If you found any issues that might have security implications, please send a report to security[at]symfony.com DO NOT PUBLISH SECURITY REPORTS PUBLICLY.
The full Security Policy is described in the official documentation.
Security: twigphp/Twig
Security
SECURITY.md
-
Fix a security issue where escaping was missing when using null coalesce operator (??)GHSA-3xg3-cgvq-2xwr published
Jan 29, 2025 by fabpotModerate -
Unguarded calls to __toString() in a sandbox when an object is in an array or an argument listGHSA-6377-hfv9-hqf6 published
Nov 6, 2024 by fabpotLow -
Unguarded calls to __isset() and to array-accesses in a sandboxGHSA-jjxq-ff2g-95vh published
Nov 6, 2024 by fabpotLow -
Possible sandbox bypassGHSA-6j75-5wfj-gh66 published
Sep 9, 2024 by fabpotHigh -
Possibility to load a template outside a configured directory when using the filesystem loaderGHSA-52m2-vc4m-jj33 published
Sep 28, 2022 by fabpotHigh -
Disallow non closures in `sort` filter when the sandbox mode is enabledGHSA-5mv2-rx3q-4w2v published
Feb 4, 2022 by fabpotHigh
Learn more about advisories related to twigphp/Twig in the GitHub Advisory Database