Twig fixes a security issue where escaping was missing when using null coalesce operator (??) (twigphp Twig)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.29 % · percentile 22 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Deferred
Description
Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.
Weaknesses (CWE)
- CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | GitHub_M |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | NVD · security-advisories@github.com (Secondary) |
Advisories
- GHSA-3xg3-cgvq-2xwr — Twig security issue where escaping was missing when using null coalesce operator
European references
- ENISA EUVD · EUVD-2025-0128
- GCVE · GCVE-0-2025-24374
Affected products
| Product | Versions |
|---|---|
| twigphp · Twig | affected >= 3.16.0, < 3.19.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |