Vulnerability in Twigphp Twig

CVE-2026-46628

Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This…

Affected products

Twigphp Twig — versions < 3.26.0

Weakness classification (CWE)

CWE-116 — Improper Encoding or Escaping of Output

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)