MediumGHSA-3xg3-cgvq-2xwrCVE-2025-24374
Twig security issue where escaping was missing when using null coalesce operator
Published 29 Jan 2025 · Updated 30 Jan 2025
Affected package
twig/twigComposer
- Affected
- >=3.16.0 <3.19.0
- Fixed in
- 3.19.0
Update to the fixed version for your release line, for example:
composer require twig/twig:^3.19.0Details
When using the ?? operator, output escaping was missing for the expression on the left side of the operator.
Is GHSA-3xg3-cgvq-2xwr in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected twig/twig, and gives you the command that fixes it.
References
- Linkgithub.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
- Advisorynvd.nist.gov/vuln/detail/CVE-2025-24374
- Linkgithub.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2025-24374.yaml
- Packagegithub.com/twigphp/Twig
- Linksymfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operator
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.