CVE-2026-46628

Analyzed Analyzed - Analysis Complete

Twig Spaceless Filter HTML Escaping Bypass

Publication date: 2026-07-14

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description

Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-03

NVD

CVE-2026-46628

Affected Vendors & Products

Vendor	Product	Version / Range
symfony	twig	to 3.26.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

Twig is a PHP template language. Before version 3.26.0, the deprecated spaceless filter was marked as safe for HTML output. When applied to untrusted input, this allowed attacker-controlled markup to bypass Twig's autoescaping, potentially rendering malicious scripts executable in user browsers.

Detection Guidance

To detect this vulnerability, check if your Twig version is below 3.26.0. Run: composer show twig/twig. If the version is older, the system is vulnerable.

Impact Analysis

If you use Twig versions before 3.26.0 with untrusted input in the spaceless filter, attackers could inject and execute malicious scripts in your application. This may lead to data theft, session hijacking, or defacement of your website.

Compliance Impact

This vulnerability could expose user data to attackers, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade Twig to version 3.26.0 or later to address the issue with the spaceless filter and ensure proper autoescaping of untrusted input.

Hi! I’m here to help you understand CVE-2026-46628. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70