Is twig/twig 3.26 vulnerable?

Composer · 1 release from 3.26.0 to 3.26.0 · latest twig/twig is 3.30.0 · checked 2 Nov 2026

Yes: 5 known advisories

Yes. twig/twig 3.26.0, the last 3.26 release, is affected by 5 known security advisories (1 high, 3 medium, 1 low), including CVE-2026-49981, CVE-2026-48808, CVE-2026-48807. Upgrade to 3.27.0 or later to fix all of them.

Upgrade with:composer require twig/twig:^3.27.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting twig/twig 3.26.0

  • HighCVE-2026-49981GHSA-529h-vh3j-85hq1 Jul 2026

    Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

    Affected
    <3.27.0
    Fixed in
    3.27.0
  • MediumCVE-2026-48808GHSA-h8vq-8gpg-mhcg30 Jun 2026

    Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

    Affected
    <3.27.0
    Fixed in
    3.27.0
  • MediumCVE-2026-48807GHSA-8x9c-rmqh-456c30 Jun 2026

    Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

    Affected
    <3.27.0
    Fixed in
    3.27.0
  • MediumCVE-2026-48806GHSA-5v5v-ww74-355v30 Jun 2026

    Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

    Affected
    <3.27.0
    Fixed in
    3.27.0
  • LowCVE-2026-48805GHSA-p42q-9prx-q5wq30 Jun 2026

    Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

    Affected
    <3.27.0
    Fixed in
    3.27.0

Which of your client projects are still on twig/twig 3.26?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact twig/twig version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other twig/twig versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.