Skip to content
OpenAdvisories

Vendor

twig

1 known vulnerabilities.

Products

cssinliner-extra 1 markdown-extra 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.1
    CVE-2026-46637

    Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

    Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other conte…

    twigphp twig Twig markdown-extra Debian Ubuntu Packagist