The `spaceless` filter implicitly marks its output as safe
May 20, 2026
#Security Advisories
#Twig
Sandbox property allowlist bypass via the `column` filter (array_column on objects)
May 20, 2026
#Security Advisories
#Twig
`template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
May 20, 2026
#Security Advisories
#Twig
Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
May 20, 2026
#Security Advisories
#Twig
Possible sandbox bypass when using a source policy
May 20, 2026
#Security Advisories
#Twig
Twig 3.26.0 released
May 20, 2026
#Releases
#Security Advisories
#Twig
❤️ 2
🚀 3