CyberRota Analysis
AI-GeneratedTwig versions prior to 3.27.0 are vulnerable due to insufficient protection for dynamic mapping keys, which can lead to the execution of the __toString() method on Stringable objects without proper sandboxing. This flaw poses a critical risk, as it could allow for arbitrary code execution in applications using Twig for templating. Developers and organizations utilizing Twig for PHP should prioritize upgrading to version 3.27.0 to mitigate this severe vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed(). This issue is fixed in version 3.27.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)