Is twig/twig 1.22 vulnerable?
Composer · 4 releases from 1.22.0 to 1.22.3 · latest twig/twig is 3.30.0 · checked 2 Nov 2026
Yes: 15 known advisories
Yes. twig/twig 1.22.3, the last 1.22 release, is affected by 15 known security advisories (1 critical, 3 high, 5 medium, 6 low), including CVE-2026-46633, CVE-2026-49981, CVE-2026-47732. Upgrade to 3.27.0 or later to fix all of them.
composer require twig/twig:^3.27.0Advisories affecting twig/twig 1.22.3
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
- Affected
- <3.27.0
- Fixed in
- 3.27.0
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
- Affected
- <3.27.0
- Fixed in
- 3.27.0
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
- Affected
- <3.27.0
- Fixed in
- 3.27.0
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
- Affected
- <3.27.0
- Fixed in
- 3.27.0
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
- Affected
- <3.27.0
- Fixed in
- 3.27.0
Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
- Affected
- <3.26.0
- Fixed in
- 3.26.0
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
- Affected
- <3.26.0
- Fixed in
- 3.26.0
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
- Affected
- <3.26.0
- Fixed in
- 3.26.0
Twig: PHP code injection via `{% use %}` template name
- Affected
- <3.26.0
- Fixed in
- 3.26.0
Twig: The `spaceless` filter implicitly marks its output as safe
- Affected
- <3.26.0
- Fixed in
- 3.26.0
Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled
- Affected
- <3.11.2 · >=3.12 <3.14.1
- Fixed in
- 3.11.2, 3.14.1
Twig has unguarded calls to `__toString()` when nesting an object into an array
- Affected
- <3.11.2 · >=3.12 <3.14.1
- Fixed in
- 3.11.2, 3.14.1
Twig has a possible sandbox bypass
- Affected
- >=1.0.0 <1.44.8 · >=2.0.0 <2.16.1 · >=3.12.0 <3.14.0 · >=3.0.0 <3.11.1
- Fixed in
- 1.44.8, 2.16.1, 3.11.1, 3.14.0
Twig may load a template outside a configured directory when using the filesystem loader
- Affected
- >=1.0.0 <1.44.7 · >=2.0.0 <2.15.3 · >=3.0.0 <3.4.3
- Fixed in
- 1.44.7, 2.15.3, 3.4.3
Twig Sandbox Information Disclosure
- Affected
- <1.38.0 · >=2.0.0 <2.7.0
- Fixed in
- 1.38.0, 2.7.0
Which of your client projects are still on twig/twig 1.22?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact twig/twig version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other twig/twig versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.