GHSA-pr2w-4gpj-cpq4
Suggest an improvement- Source
- https://github.com/advisories/GHSA-pr2w-4gpj-cpq4
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-pr2w-4gpj-cpq4/GHSA-pr2w-4gpj-cpq4.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-pr2w-4gpj-cpq4
- Aliases
- Published
- 2026-06-05T21:47:11Z
- Modified
- 2026-09-10T03:51:09Z
- Summary
- Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
- Details
-
Description
SandboxNodeVisitorenforcesSecurityPolicy::checkMethodAllowed()for implicit__toString()calls by wrapping selected AST nodes inCheckToStringNode. The set of wrapped nodes is incomplete, and several Twig language constructs still trigger PHP string coercion on aStringableoperand without first consulting the policy. A sandboxed template author can therefore invoke__toString()on any object reachable in the render context, even when__toStringon its class is not allowlisted.Confirmed bypass vectors:
- Conditional expressions (
a ? b : c,a ?: b,a ?? b) used as the input of a string-coercing filter or as a filter/function argument. - The
matchesoperator and the loose comparison operators (==,!=,<,>,<=,>=,<=>), which coerce aStringableoperand to string and can be used as an oracle to recover the value byte by byte (no tag, filter or function needs to be allowlisted). - Twig tests in general (which were never policy-gated), in particular
is emptywhich casts aStringablevalue via(string) $valueinCoreExtension::testEmpty(). - Null-coalesce expressions nested in concatenation, and the direct output of allowed functions or filters that return a
Stringableobject. - Arguments passed to allowed object methods, template-name expressions of template-loading tags (
include,extends,use, ...), dynamic attribute/property names, and spread arguments fromTraversableobjects. - The
dotag and the..range operator.
Resolution
The sandbox now wraps every child node that the parent will string-coerce at runtime, instead of relying on a hardcoded list of node types in
SandboxNodeVisitor. A newTwig\Node\CoercesChildrenToStringInterfacelets nodes declare which of their children must be guarded; core nodes (concatenation, comparison and range binaries, filter/function/test expressions,do,include,extends,use, ...) implement it. Spread arguments are materialised and policy-checked via the newSandboxExtension::ensureSpreadAllowed(), and dynamic attribute names are checked at runtime insideCoreExtension::getAttribute().Credits
Twig would like to thank Anthropic Glasswing and El Kharoubi Iosif for reporting the issues, and Fabien Potencier for providing the fixes.
- Conditional expressions (
- Database specific
{ "cwe_ids": [ "CWE-20" ], "github_reviewed": true, "github_reviewed_at": "2026-06-05T21:47:11Z", "nvd_published_at": null, "severity": "HIGH" }- References
Affected packages
Packagist / twig/twig
Package
- Name
- twig/twig
- Purl
- pkg:composer/twig/twig
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3.26.0