Packagist/twig/twig CVE-2026-46628: medium 5.4, EPSS 0.29%

Twig: The `spaceless` filter implicitly marks its output as safe

Action: Upgrade twig/twig to 3.26.0 or later.

composer require twig/twig:3.26.0

Affected

Fixed versions

Sources

• osv: GHSA-4j38-f5cw-54h7
• nvd: CVE-2026-46628
• https://github.com/twigphp/Twig/security/advisories/GHSA-4j38-f5cw-54h7
• https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-46628.yaml
• https://github.com/twigphp/Twig
• https://symfony.com/cve-2026-46628

CVE-2026-46628 · published 2026-05-21T21:21:35Z · modified 2026-09-10T03:50:45.504087961Z · JSON