CyberRota Analysis
AI-GeneratedTwig versions prior to 3.27.0 are vulnerable due to insufficient sandbox checks in the __toString() method, which can allow Traversable values containing Stringable objects to be coerced into strings without adhering to the sandbox policy. This flaw poses a critical risk, as it may lead to unauthorized code execution or data exposure within applications using Twig for templating. Developers and organizations utilizing Twig for PHP template rendering should prioritize upgrading to version 3.27.0 to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)