GHSA-2g2g-8p8h-fgwm

Suggest an improvement
Source
https://github.com/advisories/GHSA-2g2g-8p8h-fgwm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2g2g-8p8h-fgwm/GHSA-2g2g-8p8h-fgwm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2g2g-8p8h-fgwm
Aliases
Published
2026-06-05T21:46:26Z
Modified
2026-09-10T03:51:07Z
Summary
Twig: XSS in profiler HtmlDumper via unescaped template and profile names
Details

Description

Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() straight into its HTML output without escaping:

protected function formatTemplate(Profile $profile, $prefix): string
{
    return \sprintf('%s└ <span style="background-color: %s">%s</span>', $prefix, self::$colors['template'], $profile->getTemplate());
}

The template name comes from the loader (the array key for ArrayLoader, a row id for a database-backed loader, etc.). When that name is attacker-controlled, the profiler dump emits arbitrary HTML, and any browser that renders it executes the injected markup. This is an output-encoding bug in profiler/debug tooling, not a sandbox escape.

Resolution

HtmlDumper now runs both Profile::getTemplate() and Profile::getName() through htmlspecialchars() before inserting them into the HTML output.

Credits

Twig would like to thank El Kharoubi Iosif for reporting the issue and Nicolas Grekas for fixing it.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-05T21:46:26Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}
References

Affected packages

Packagist / twig/twig

Package

Name
twig/twig
Purl
pkg:composer/twig/twig

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.26.0

Affected versions

v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.1.0
v3.1.1
v3.2.1
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v3.3.8
v3.3.9
v3.3.10
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.5.0
v3.5.1
v3.6.0
v3.6.1
v3.7.0
v3.7.1
v3.8.0
v3.9.0
v3.9.1
v3.9.2
v3.9.3
v3.10.0
v3.10.1
v3.10.2
v3.10.3
v3.11.0
v3.11.1
v3.11.2
v3.11.3
v3.12.0
v3.13.0
v3.14.0
v3.14.1
v3.14.2
v3.15.0
v3.16.0
v3.17.0
v3.17.1
v3.18.0
v3.19.0
v3.20.0
v3.21.0
v3.21.1
v3.22.0
v3.22.1
v3.22.2
v3.23.0
v3.24.0
v3.25.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2g2g-8p8h-fgwm/GHSA-2g2g-8p8h-fgwm.json"