« Twig » blog posts

XSS in profiler HtmlDumper via unescaped template and profile names

Arbitrary PHP code execution via `_self.()` macro-reference compilation

Possible sandbox bypass when using a source policy

Twig 3.26.0 released

Twig 3.25.0 ships with a new ``needs_is_sandboxed`` option that lets filters, functions, and tests adapt their behavior when running inside a sandbox, makes the compiled output of templates using ``{% embed %}`` deterministic across runs, and removes a long-standing limitation that prevented overriding ``EscaperRuntime`` via a custom runtime loader.

Twig 3.24.0 has just been released with a major new feature for working with HTML attributes, improved null-safe operator behavior, and variable renaming in object destructuring.

Twig 3.23: Introducing new operators and destructuring support

Twig CVE-2025-24374: Missing output escaping for the null coalesce operator

Introducing the new Twig Playground

Twig 3.15 introduces dynamic dot operator support, named arguments in macros, argument unpacking, and universal arrow function usage.