Twig is a template language for PHP. Prior to version 3.26.0, several filters in the twig/markdown-extra and twig/cssinliner-extra extensions were registered with the attribute is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. Consequently, user‑supplied content that is rendered by these filters could be injected into web pages or other outputs without escaping, potentially leading to cross‑site scripting or other injection attacks. The weakness corresponds to CWE‑116 (Improper Encoding or Escaping). The issue is resolved by upgrading to version 3.26.0 or later.

All installations of the Twig PHP template engine prior to version 3.26.0 that depend on the cssinliner‑extra or markdown‑extra extensions are affected. Systems that use earlier releases of Twig must update to 3.26.0 or a later version that includes the fix.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score of less than 1% suggests a very low likelihood that this vulnerability is being actively exploited in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector is the delivery of crafted template content that is rendered by Twig, leading to unsafe output in a web page or other context. However, no remote code execution or privilege escalation is described, and exploitation requires access to template rendering in an untrusted context.