DRUPAL-CORE-2022-016 in drupal/core
Published 28 Sept 2022 · Updated 19 Sept 2026
Affected package
- Affected
- >=8.0.0 <9.3.22 · >=9.4.0 <9.4.7
- Fixed in
- 9.3.22, 9.4.7
composer require drupal/core:^9.4.7Details
Drupal uses the Twig third-party library for content templating and sanitization. Twig has released a security update that affects Drupal. Twig has rated the vulnerability as high severity.
Drupal core's code extending Twig has also been updated to mitigate a related vulnerability.
Multiple vulnerabilities are possible if an untrusted user has access to write Twig code, including potential unauthorized read access to private files, the contents of other files on the server, or database credentials.
The vulnerability is mitigated by the fact that an exploit is only possible in Drupal core with a restricted access administrative permission. Additional exploit paths for the same vulnerability may exist with contributed or custom code that allows users to write Twig templates.
Is DRUPAL-CORE-2022-016 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected drupal/core, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.