The Webprofiler module provides a way of displaying the Symfony profile debugging tool at the bottom of each page. The abbr\_class Twig fil…

The Webprofiler module provides a way of displaying the Symfony profile debugging tool at the bottom of each page.

The abbr\_class Twig filter can be used to bypass the Twig auto-escape feature.

This vulnerability is mitigated by the fact that it is only exposed when the filter is specifically used in a theme to render content that contains an attack vector.