GHSA-24x9-r6q4-q93w
Suggest an improvement- Source
- https://github.com/advisories/GHSA-24x9-r6q4-q93w
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-24x9-r6q4-q93w/GHSA-24x9-r6q4-q93w.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-24x9-r6q4-q93w
- Aliases
-
- CVE-2026-46634
- Related
- Published
- 2026-05-21T21:25:12Z
- Modified
- 2026-05-22T22:44:48.132713282Z
- Summary
- Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
- Details
-
Description
When the sandbox is enabled selectively via
SourcePolicyInterface(and not globally), a sandboxed template that is allowed to calltemplate_from_stringandincludecan render an arbitrary inner template with no security policy enforcement.Environment::createTemplate()compiles the inner string under a synthesized name (__string_template__<hash>), so a name/path-basedSourcePolicyreturnsfalsefor it, and the inner template'scheckSecurity()becomes a no-op. From a template the integrator believes is sandboxed, an attacker can use any tag/filter/function (includingconstant()to read secrets, or|map("system")to execute shell commands).Resolution
This is a configuration trap rather than a code bug: there is no legitimate use case for exposing
template_from_stringto untrusted template authors, and propagating the parent sandbox state throughtemplate_from_stringwould require invasive changes toSourcePolicyInterfacesemantics with their own risks.Starting with Twig 3.26.0, the documentation and the PHPDoc of
StringLoaderExtension::templateFromString()explicitly warn against allowingtemplate_from_stringin a sandboxed environment (i.e. listing it in aSecurityPolicyallowed-functions list). Integrators using aSourcePolicyInterfaceMUST NOT allowtemplate_from_stringin their allowed functions; the safest option is not to registerStringLoaderExtensionat all when a sandbox is in use.Credits
Twig would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue.
- Database specific
{ "cwe_ids": [ "CWE-693" ], "github_reviewed": true, "nvd_published_at": null, "github_reviewed_at": "2026-05-21T21:25:12Z", "severity": "MODERATE" }- References
Affected packages
Packagist / twig/twig
Package
- Name
- twig/twig
- Purl
- pkg:composer/twig%2Ftwig