Is twig/twig 3.11 vulnerable?
Composer · 4 releases from 3.11.0 to 3.11.3 · latest twig/twig is 3.30.0 · checked 2 Nov 2026
Yes: 13 known advisories
Yes. twig/twig 3.11.3, the last 3.11 release, is affected by 13 known security advisories (1 critical, 3 high, 5 medium, 4 low), including CVE-2026-46633, CVE-2026-49981, CVE-2026-47732. 3 more affect earlier 3.11.x releases. Upgrade to 3.27.0 or later to fix all of them.
composer require twig/twig:^3.27.0Advisories affecting twig/twig 3.11.3
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
- Affected
- <3.27.0
- Fixed in
- 3.27.0
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
- Affected
- <3.27.0
- Fixed in
- 3.27.0
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
- Affected
- <3.27.0
- Fixed in
- 3.27.0
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
- Affected
- <3.27.0
- Fixed in
- 3.27.0
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
- Affected
- <3.27.0
- Fixed in
- 3.27.0
Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
- Affected
- <3.26.0
- Fixed in
- 3.26.0
Twig: XSS in profiler HtmlDumper via unescaped template and profile names
- Affected
- >=3.0.0 <3.26.0
- Fixed in
- 3.26.0
Twig: Possible sandbox bypass when using a source policy
- Affected
- >=2.16.0 <=2.16.1 · >=3.9.0 <3.26.0
- Fixed in
- 3.26.0
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
- Affected
- <3.26.0
- Fixed in
- 3.26.0
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
- Affected
- <3.26.0
- Fixed in
- 3.26.0
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
- Affected
- >=3.9.0 <3.26.0
- Fixed in
- 3.26.0
Twig: PHP code injection via `{% use %}` template name
- Affected
- <3.26.0
- Fixed in
- 3.26.0
Twig: The `spaceless` filter implicitly marks its output as safe
- Affected
- <3.26.0
- Fixed in
- 3.26.0
Fixed within 3.11.x, affecting earlier releases
Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled
- Affected
- <3.11.2 · >=3.12 <3.14.1
- Fixed in
- 3.11.2, 3.14.1
Twig has unguarded calls to `__toString()` when nesting an object into an array
- Affected
- <3.11.2 · >=3.12 <3.14.1
- Fixed in
- 3.11.2, 3.14.1
Twig has a possible sandbox bypass
- Affected
- >=1.0.0 <1.44.8 · >=2.0.0 <2.16.1 · >=3.12.0 <3.14.0 · >=3.0.0 <3.11.1
- Fixed in
- 1.44.8, 2.16.1, 3.11.1, 3.14.0
Which of your client projects are still on twig/twig 3.11?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact twig/twig version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other twig/twig versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.