Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` filters and via the `in`/`not in` operators
May 27, 2026
#Twig
Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
May 27, 2026
#Twig
CVE-2026-47732 Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
May 20, 2026
#Twig
The `spaceless` filter implicitly marks its output as safe
May 20, 2026
#Twig
Sandbox property allowlist bypass via the `column` filter (array_column on objects)
May 20, 2026
#Twig
Sandbox does not protect against resource exhaustion
May 20, 2026
#Twig
`template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
May 20, 2026
#Twig
PHP code injection via `{% use %}` template name
May 20, 2026
#Twig
Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
May 20, 2026
#Twig