CyberRota Analysis
AI-GeneratedThe Twig template engine for PHP is vulnerable due to the improper handling of the deprecated spaceless filter, which allows attacker-controlled markup to be emitted unescaped when applied to untrusted input. This can lead to cross-site scripting (XSS) vulnerabilities, potentially compromising the security of web applications that utilize affected versions. Developers and organizations using Twig versions prior to 3.26.0 should prioritize upgrading to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)