Twig has unguarded calls to `__toString()` when nesting an object into an array
Published 6 Nov 2024 · Updated 29 May 2025
Affected packages
- Affected
- <3.11.2
- Fixed in
- 3.11.2
composer require twig/twig:^3.11.2- Affected
- >=3.12 <3.14.1
- Fixed in
- 3.14.1
composer require twig/twig:^3.14.1Details
Description
In a sandbox, an attacker can call __toString() on an object even if the __toString() method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance).
Resolution
The sandbox mode now checks the __toString() method call on all objects.
The patch for this issue is available here for the 3.11.x branch, and here for the 3.x branch.
Credits
We would like to thank Jamie Schouten for reporting the issue and Fabien Potencier for providing the fix.
Is GHSA-6377-hfv9-hqf6 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected twig/twig, and gives you the command that fixes it.
References
- Linkgithub.com/twigphp/Twig/security/advisories/GHSA-6377-hfv9-hqf6
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-51754
- Linkgithub.com/twigphp/Twig/commit/2bb8c2460a2c519c498df9b643d5277117155a73
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2024-51754.yaml
- Packagegithub.com/twigphp/Twig
- Linklists.debian.org/debian-lts-announce/2025/05/msg00039.html
- Linksymfony.com/blog/unguarded-calls-to-__tostring-when-nesting-an-object-into-an-array
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.