GHSA-3xg3-cgvq-2xwrMediumCVSS 4.3
Twig security issue where escaping was missing when using null coalesce operator
🔗 CVE IDs covered (1)
📋 Description
When using the ?? operator, output escaping was missing for the expression on the left side of the operator.
🎯 Affected products1
- composer/twig/twig:>= 3.16.0, < 3.19.0
🔗 References (6)
- https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
- https://nvd.nist.gov/vuln/detail/CVE-2025-24374
- https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2025-24374.yaml
- https://symfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operator
- https://github.com/advisories/GHSA-3xg3-cgvq-2xwr