CVE-2026-46637 Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

What is CVE-2026-46637?

CVE-2026-46637 is a medium-severity cross-site scripting vulnerability in Twig, published on 14 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. This issue is fixed in version 3.26.0.

Weakness: CWE-79, CWE-116

Which versions are affected by CVE-2026-46637?

4 open source packages ship an affected version, including twig/cssinliner-extra and twig/markdown-extra. It affects 1 product.

Products include Symfony Twig.

How do I fix CVE-2026-46637?

Upgrade twig/cssinliner-extra to 3.26.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-46637 being exploited?

There is no known exploitation of CVE-2026-46637 in the wild and no public exploit code.

Other vulnerabilities in Twig

• CVE-2018-13818 Code injection in n/a Critical 9.8
• CVE-2026-46633 Twig: PHP code injection via `{% use %}` template name High 8.7
• CVE-2026-46640 Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation High 8.7
• CVE-2026-24425 Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface High 8.7
• CVE-2024-45411 Twig has a possible sandbox bypass High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-46637, GHSA-jv8m-2544-3pg3, UBUNTU-CVE-2026-46637.