GHSA-7fxw-r6jv-74c8
Suggest an improvement- Source
- https://github.com/advisories/GHSA-7fxw-r6jv-74c8
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-7fxw-r6jv-74c8/GHSA-7fxw-r6jv-74c8.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-7fxw-r6jv-74c8
- Aliases
-
- CVE-2026-46638
- Related
- Published
- 2026-05-21T21:28:28Z
- Modified
- 2026-05-22T22:44:48.214102342Z
- Severity
-
- 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator
- Summary
- Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
- Details
-
Description
The fix for CVE-2024-45411 / GHSA-6j75-5wfj-gh66 added an explicit
$loaded->unwrap()->checkSecurity()call inCoreExtension::include()so that a template already cached inEnvironment::$loadedTemplatesis re-checked when included withsandboxed = true.The deprecated but still functional
{% sandbox %}{% include ... %}{% endsandbox %}tag path was not updated: it compiles toenableSandbox(); yield from $this->load(...)->unwrap()->yield(...); disableSandbox();with nocheckSecurity()re-invocation. If the included template was loaded once outside the sandbox in the sameEnvironmentinstance, its constructor (and therefore its compiledcheckSecurity()call) already ran whileisSandboxed()wasfalse, so the tags/filters/functions allowlist enforced bySecurityPolicy::checkSecurity()is never applied.An attacker who can author the included template gains access to every filter, function and tag registered in the environment, regardless of the sandbox policy.
Resolution
The compiled output of
{% sandbox %}{% include %}now callscheckSecurity()on the loaded template, matching the behaviour ofCoreExtension::include()withsandboxed = true.Credits
Twig would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Database specific
{ "cwe_ids": [ "CWE-693" ], "github_reviewed": true, "github_reviewed_at": "2026-05-21T21:28:28Z", "nvd_published_at": null, "severity": "MODERATE" }- References
Affected packages
Packagist / twig/twig
Package
- Name
- twig/twig
- Purl
- pkg:composer/twig%2Ftwig
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed3.26.0