Description
Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.
Published: 2026-07-14
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig auto‑escaping to emit attacker‑controlled markup unescaped when the filter is applied to untrusted input. This bypasses the templating engine’s protection, enabling an attacker to inject arbitrary HTML or JavaScript and conduct cross‑site scripting attacks.

Affected Systems

The vendor twigphp:Twig is affected. All Twig installations of version 3.x before 3.26.0 use the spaceless filter. Any environment that renders untrusted data through templates and applies the spaceless filter is impacted.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate risk, while the EPSS score of < 1% denotes a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web application that passes untrusted data to a template with the filter applied, thereby bypassing auto‑escaping and enabling XSS.

Generated by OpenCVE AI on July 31, 2026 at 04:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Twig to version 3.26.0 or later, which removes the unsafe registration of the spaceless filter.
  • If an upgrade is not immediately feasible, eliminate or refactor all template usage of the spaceless filter, or strictly sanitize untrusted input before applying the filter.
  • Configure the Twig environment to disallow deprecated filters so that future regressions cannot re‑introduce the issue.

Generated by OpenCVE AI on July 31, 2026 at 04:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6311-1 php-twig security update
Debian DSA Debian DSA DSA-6320-1 php-twig security update
Github GHSA Github GHSA GHSA-4j38-f5cw-54h7 Twig: The `spaceless` filter implicitly marks its output as safe
History

Wed, 15 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Twigphp
Twigphp twig
Vendors & Products Twigphp
Twigphp twig

Wed, 15 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.
Title Twig: The `spaceless` filter implicitly marks its output as safe
Weaknesses CWE-116
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Twigphp Twig
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-15T12:49:21.254Z

Reserved: 2026-05-15T19:34:14.013Z

Link: CVE-2026-46628

cve-icon Vulnrichment

Updated: 2026-07-15T12:49:06.927Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T04:45:17Z

Weaknesses
  • CWE-116

    Improper Encoding or Escaping of Output