« Twig » blog posts

XSS in profiler HtmlDumper via unescaped template and profile names

Arbitrary PHP code execution via `_self.(

`{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

Sandbox property allowlist bypass via the `column` filter (array_column on objects)

HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

Sandbox property and method bypass via object-destructuring assignment

Possible sandbox bypass when using a source policy

Twig 3.26.0 released

Twig 3.25.0 ships with a new ``needs_is_sandboxed`` option that lets filters, functions, and tests adapt their behavior when running inside a sandbox, makes the compiled output of templates using ``{% embed %}`` deterministic across runs, and removes a long-standing limitation that prevented overriding ``EscaperRuntime`` via a custom runtime loader.

Twig 3.24.0 has just been released with a major new feature for working with HTML attributes, improved null-safe operator behavior, and variable renaming in object destructuring.