HighGHSA-5mv2-rx3q-4w2vCVE-2022-23614

Code injection in Twig

Published 10 Feb 2022 · Updated 16 Feb 2024

Affected packages

twig/twigComposer

Affected: >=2.0.0 <2.14.11
Fixed in: 2.14.11

Update to the fixed version for your release line, for example:composer require twig/twig:^2.14.11

twig/twigComposer

Affected: >=3.0.0 <3.3.8
Fixed in: 3.3.8

Update to the fixed version for your release line, for example:composer require twig/twig:^3.3.8

Details

Description

When in a sandbox mode, the arrow parameter of the sort filter must be a closure to avoid attackers being able to run arbitrary PHP functions.

Resolution

We now disallow calling non Closure in the sort filter like we already did for some other filters.

Credits

We would like to thank Marlon Starkloff for reporting the issue and Fabien Potencier for fixing the issue.

Is GHSA-5mv2-rx3q-4w2v in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected twig/twig, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.