Every CVE Search/ Get API key

CVE-2026-46628

Twig: The `spaceless` filter implicitly marks its output as safe

5.1 MediumFix available

Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.29%Up 0.2 points since Jun 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.1

Twig: The `spaceless` filter implicitly marks its output as safe

Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.

Record
CVE-2026-46628
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-116
Updated
2026-11-02
EUVDEUVD-2026-44566 5.1

Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.

Record
EUVD-2026-44566
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-4j38-f5cw-54h7 1.3

Twig: The `spaceless` filter implicitly marks its output as safe

Description

The spaceless filter is registered with is_safe => ['html'], which means Twig's autoescaper does not escape its output in an HTML context. As a result, applying spaceless to attacker-controlled input that contains markup emits the markup unescaped even when the developer never wrote |raw and autoescape is enabled.

Example:

{% set payload = '<script>alert()</script>' %}
{{ payload }}          {# escaped #}
{{ payload|spaceless }} {# not escaped #}

The filter is deprecated but still functional. With the deprecation, some downstream projects (e.g. Drupal modules) have duplicated the filter and inherited the same is_safe flag.

Resolution

The spaceless filter no longer marks its output as safe. Documentation has been updated to warn that spaceless should not be applied to unsanitised user input.

Credits

Twig would like to thank Pierre Rudloff for reporting the issue.

Record
GHSA-4j38-f5cw-54h7
CVSS 4.0
1.3 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
Weakness
CWE-116
Updated
2026-11-02
NVD 5.1

Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.

Record
CVE-2026-46628
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-116
Updated
2026-11-02
OSV 5.1

Twig: The `spaceless` filter implicitly marks its output as safe

Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.

Record
CVE-2026-46628
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-116
Updated
2026-11-02
OSVDEBIAN-CVE-2026-46628 5.4

Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.

Record
DEBIAN-CVE-2026-46628
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-4j38-f5cw-54h7 1.3

Twig: The `spaceless` filter implicitly marks its output as safe

Description

The spaceless filter is registered with is_safe => ['html'], which means Twig's autoescaper does not escape its output in an HTML context. As a result, applying spaceless to attacker-controlled input that contains markup emits the markup unescaped even when the developer never wrote |raw and autoescape is enabled.

Example:

{% set payload = '<script>alert()</script>' %}
{{ payload }}          {# escaped #}
{{ payload|spaceless }} {# not escaped #}

The filter is deprecated but still functional. With the deprecation, some downstream projects (e.g. Drupal modules) have duplicated the filter and inherited the same is_safe flag.

Resolution

The spaceless filter no longer marks its output as safe. Documentation has been updated to warn that spaceless should not be applied to unsanitised user input.

Credits

Twig would like to thank Pierre Rudloff for reporting the issue.

Record
GHSA-4j38-f5cw-54h7
CVSS 4.0
1.3 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
Weakness
CWE-116
Updated
2026-11-02
OSVUBUNTU-CVE-2026-46628 5.1

Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.

Record
UBUNTU-CVE-2026-46628
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVCLSA-2026-1783991054 No score

TuxCare security update for twig/twig (11 CVEs)

TuxCare rebuilt twig/twig to address 11 CVEs. Fixed in v2.16.1-p1+tuxcare.

Record
CLSA-2026-1783991054
Updated
2026-11-02
OSVCLSA-2026-1784682913 No score

TuxCare security update for twig/twig (10 CVEs)

TuxCare rebuilt twig/twig to address 10 CVEs. Fixed in v2.15.6-p2+tuxcare.

Record
CLSA-2026-1784682913
Updated
2026-11-02
OSVCLSA-2026-1786534048 No score

TuxCare security update for twig/twig (8 CVEs)

TuxCare rebuilt twig/twig to address 8 CVEs. Fixed in v1.44.8-p1+tuxcare.

Record
CLSA-2026-1786534048
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
twig/twig
Packagist
 before 3.26.0
3.26.0
twig/twig
TuxCare:Packagist
From an advisory covering 11 CVEs
 v2.16.1 up to v2.16.1-p1+tuxcare
v2.16.1-p1+tuxcare
twig/twig
TuxCare:Packagist
From an advisory covering 10 CVEs
 v2.15.6 up to v2.15.6-p2+tuxcare, plus listed versions
v2.15.6-p1+tuxcare
v2.15.6-p2+tuxcare
twig/twig
TuxCare:Packagist
From an advisory covering 8 CVEs
 v1.44.8 up to v1.44.8-p1+tuxcare
v1.44.8-p1+tuxcare
php-twig
Debian:12
 before 3.5.1-1+deb12u3, plus listed versions
3.5.1-13.5.1-1+deb12u13.5.1-1+deb12u2
3.5.1-1+deb12u3
php-twig
Debian:13
 before 3.27.0-0+deb13u1, plus listed versions
3.20.0-23.21.1-13.21.1-23.21.1-33.22.0-1
Show 11 moreShow less
3.22.0-23.22.1-13.22.1-23.22.1-33.22.2-13.22.2-23.23.0-13.23.0-23.24.0-13.26.0-0+deb13u13.26.0-1
3.27.0-0+deb13u1
php-twig
Debian:14
 before 3.26.0-1, plus listed versions
3.20.0-23.21.1-13.21.1-23.21.1-33.22.0-1
Show 9 moreShow less
3.22.0-23.22.1-13.22.1-23.22.1-33.22.2-13.22.2-23.23.0-13.23.0-23.24.0-1
3.26.0-1
twig/twig
Packagist
 before 3.26.0, plus listed versions
1.3.01.4.01.5.01.5.11.6.0
Show 45 moreShow less
1.6.11.6.21.6.31.6.41.6.5v1.10.0v1.10.1v1.10.2v1.10.3v1.11.0v1.11.1v1.12.0v1.12.0-RC1v1.12.1v1.12.2v1.12.3v1.13.0v1.13.1v1.13.2v1.14.0v1.14.1v1.14.2v1.15.0v1.15.1v1.16.0v1.16.1v1.16.2v1.16.3v1.17.0v1.18.0v1.18.1v1.18.2v1.19.0v1.20.0v1.21.0v1.21.1v1.21.2v1.22.0v1.22.1v1.22.2v1.22.3v1.23.0v1.23.1v1.23.2v1.23.3
3.26.0
php-twig
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.11.3-22.12.1-12.12.2-12.12.3-12.12.5-12.12.5-1ubuntu0.1~esm12.12.5-1ubuntu0.1~esm2
 None known
php-twig
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
3.3.2-1ubuntu33.3.4-13.3.6-13.3.7-13.3.8-2ubuntu43.3.8-2ubuntu4+esm13.3.8-2ubuntu4+esm2
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
php-twig
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.7.0-13.7.1-13.8.0-23.8.0-2ubuntu0.1~esm13.8.0-2ubuntu13.8.0-2ubuntu1+esm1
 None known
php-twig
Ubuntu:25.10
 All versions, plus listed versions
3.20.0-2ubuntu1
 None known
php-twig
Ubuntu:26.10
 All versions, plus listed versions
3.23.0-2build73.27.1-13.28.0-1
 None known
php-twig
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
3.20.0-2ubuntu13.23.0-2build53.23.0-2build73.23.0-2ubuntu0.1~esm1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-46628 is a medium vulnerability (CVSS 5.1) in Symfony Twig, published May 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. Fixed in twig/twig 3.26.0.

References

Show 7 moreShow less
This page doesn't list everything

Left out here: 192 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open