Is twig/twig 2.3 vulnerable?

Composer · 3 releases from 2.3.0 to 2.3.2 · latest twig/twig is 3.30.0 · checked 2 Nov 2026

Yes: 16 known advisories

Yes. twig/twig 2.3.2, the last 2.3 release, is affected by 16 known security advisories (1 critical, 4 high, 5 medium, 6 low), including CVE-2026-46633, CVE-2026-49981, CVE-2026-47732. Upgrade to 3.27.0 or later to fix all of them.

Upgrade with:composer require twig/twig:^3.27.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting twig/twig 2.3.2

  • HighCVE-2026-49981GHSA-529h-vh3j-85hq1 Jul 2026

    Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

    Affected
    <3.27.0
    Fixed in
    3.27.0
  • MediumCVE-2026-48808GHSA-h8vq-8gpg-mhcg30 Jun 2026

    Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

    Affected
    <3.27.0
    Fixed in
    3.27.0
  • MediumCVE-2026-48807GHSA-8x9c-rmqh-456c30 Jun 2026

    Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

    Affected
    <3.27.0
    Fixed in
    3.27.0
  • MediumCVE-2026-48806GHSA-5v5v-ww74-355v30 Jun 2026

    Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

    Affected
    <3.27.0
    Fixed in
    3.27.0
  • LowCVE-2026-48805GHSA-p42q-9prx-q5wq30 Jun 2026

    Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

    Affected
    <3.27.0
    Fixed in
    3.27.0
  • HighCVE-2026-47732GHSA-pr2w-4gpj-cpq45 Jun 2026

    Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points

    Affected
    <3.26.0
    Fixed in
    3.26.0
  • MediumCVE-2026-46638GHSA-7fxw-r6jv-74c821 May 2026

    Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

    Affected
    <3.26.0
    Fixed in
    3.26.0
  • LowCVE-2026-46635GHSA-vcc8-phrv-43wj21 May 2026

    Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)

    Affected
    <3.26.0
    Fixed in
    3.26.0
  • CriticalCVE-2026-46633GHSA-7p85-w9px-jpjp21 May 2026

    Twig: PHP code injection via `{% use %}` template name

    Affected
    <3.26.0
    Fixed in
    3.26.0
  • LowCVE-2026-46628GHSA-4j38-f5cw-54h721 May 2026

    Twig: The `spaceless` filter implicitly marks its output as safe

    Affected
    <3.26.0
    Fixed in
    3.26.0
  • LowCVE-2024-51755GHSA-jjxq-ff2g-95vh6 Nov 2024

    Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled

    Affected
    <3.11.2 · >=3.12 <3.14.1
    Fixed in
    3.11.2, 3.14.1
  • LowCVE-2024-51754GHSA-6377-hfv9-hqf66 Nov 2024

    Twig has unguarded calls to `__toString()` when nesting an object into an array

    Affected
    <3.11.2 · >=3.12 <3.14.1
    Fixed in
    3.11.2, 3.14.1
  • MediumCVE-2024-45411GHSA-6j75-5wfj-gh669 Sept 2024

    Twig has a possible sandbox bypass

    Affected
    >=1.0.0 <1.44.8 · >=2.0.0 <2.16.1 · >=3.12.0 <3.14.0 · >=3.0.0 <3.11.1
    Fixed in
    1.44.8, 2.16.1, 3.11.1, 3.14.0
  • HighCVE-2022-39261GHSA-52m2-vc4m-jj3330 Sept 2022

    Twig may load a template outside a configured directory when using the filesystem loader

    Affected
    >=1.0.0 <1.44.7 · >=2.0.0 <2.15.3 · >=3.0.0 <3.4.3
    Fixed in
    1.44.7, 2.15.3, 3.4.3
  • LowCVE-2019-9942GHSA-vxrc-68xx-x48g26 Mar 2022

    Twig Sandbox Information Disclosure

    Affected
    <1.38.0 · >=2.0.0 <2.7.0
    Fixed in
    1.38.0, 2.7.0
  • HighCVE-2022-23614GHSA-5mv2-rx3q-4w2v10 Feb 2022

    Code injection in Twig

    Affected
    >=2.0.0 <2.14.11 · >=3.0.0 <3.3.8
    Fixed in
    2.14.11, 3.3.8

Which of your client projects are still on twig/twig 2.3?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact twig/twig version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other twig/twig versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.