Protection Mechanism Failure in Twig - CVE-2026-46634

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass sandbox restrictions and execute arbitrary code or disclose sensitive information.

The vulnerability exists due to protection mechanism failure in StringLoaderExtension::templateFromString() and Environment::createTemplate() when rendering an inner template from a sandboxed template under a SourcePolicyInterface-driven selective sandbox. A remote attacker can invoke template_from_string and include to render a synthesized inner template without security policy enforcement to bypass sandbox restrictions and execute arbitrary code or disclose sensitive information.

The issue occurs when the sandbox is enabled selectively via SourcePolicyInterface rather than globally, and the synthesized template name causes name-based policy checks to be skipped for the inner template.

How to mitigate CVE-2026-46634

Sources

• https://github.com/twigphp/Twig/security/advisories/GHSA-24x9-r6q4-q93w
• https://github.com/twigphp/Twig/security/advisories/GHSA-5mv2-rx3q-4w2v