Packagist/twig/markdown-extra CVE-2026-46637: medium 5.4, EPSS 0.30%

Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

Action: Upgrade twig/markdown-extra to 3.26.0 or later.

composer require twig/markdown-extra:3.26.0

Affected

Fixed versions

Sources

• osv: GHSA-jv8m-2544-3pg3
• nvd: CVE-2026-46637
• https://github.com/twigphp/Twig/security/advisories/GHSA-jv8m-2544-3pg3
• https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/cssinliner-extra/CVE-2026-46637.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/markdown-extra/CVE-2026-46637.yaml
• https://github.com/twigphp/Twig
• https://symfony.com/cve-2026-46637

CVE-2026-46637 · published 2026-05-21T21:27:20Z · modified 2026-09-10T03:51:06.308160656Z · JSON