Twig fixes a security issue where escaping was missing when using null coalesce operator (??) (twigphp Twig)
En bref
- Source
- NVD
- EPSS
- EPSS 0.29 % · centile 22 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Deferred
Description
Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.
Faiblesses (CWE)
- CWE-74 — Neutralisation incorrecte d'éléments spéciaux (injection)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | GitHub_M |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | NVD · security-advisories@github.com (Secondary) |
Avis
- GHSA-3xg3-cgvq-2xwr — Twig security issue where escaping was missing when using null coalesce operator
Références européennes
- ENISA EUVD · EUVD-2025-0128
- GCVE · GCVE-0-2025-24374
Produits affectés
| Produit | Versions |
|---|---|
| twigphp · Twig | affected >= 3.16.0, < 3.19.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |