MediumGHSA-6j75-5wfj-gh66CVE-2024-45411

Twig has a possible sandbox bypass

Published 9 Sept 2024 · Updated 10 Oct 2024

Affected packages

twig/twigComposer
Affected
>=1.0.0 <1.44.8
Fixed in
1.44.8
Update to the fixed version for your release line, for example:composer require twig/twig:^1.44.8
twig/twigComposer
Affected
>=2.0.0 <2.16.1
Fixed in
2.16.1
Update to the fixed version for your release line, for example:composer require twig/twig:^2.16.1
twig/twigComposer
Affected
>=3.12.0 <3.14.0
Fixed in
3.14.0
Update to the fixed version for your release line, for example:composer require twig/twig:^3.14.0
twig/twigComposer
Affected
>=3.0.0 <3.11.1
Fixed in
3.11.1
Update to the fixed version for your release line, for example:composer require twig/twig:^3.11.1

Details

Description

Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.

The security issue happens when all these conditions are met:

  • The sandbox is disabled globally;
  • The sandbox is enabled via a sandboxed include() function which references a template name (like included.twig) and not a Template or TemplateWrapper instance;
  • The included template has been loaded before the include() call but in a non-sandbox context (possible as the sandbox has been globally disabled).

Resolution

The patch ensures that the sandbox security checks are always run at runtime.

Credits

We would like to thank Fabien Potencier for reporting and fixing the issue.

Is GHSA-6j75-5wfj-gh66 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected twig/twig, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.