CVE-2024-45411

Packagist/twig/twig CVE-2024-45411: high 8.5, EPSS 0.85%

Twig has a possible sandbox bypass

Action: Upgrade twig/twig to 1.44.8 or later.

composer require twig/twig:1.44.8

composer require twig/twig:2.16.1

composer require twig/twig:3.14.0

composer require twig/twig:3.11.1

Affected

Fixed versions

Sources

• osv: GHSA-6j75-5wfj-gh66
• https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66
• https://nvd.nist.gov/vuln/detail/CVE-2024-45411
• https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6
• https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de
• https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635
• https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233
• https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2024-45411.yaml
• https://github.com/twigphp/Twig
• https://symfony.com/blog/twig-security-release-possible-sandbox-bypass

CVE-2024-45411 · published 2024-09-09T20:19:26Z · modified 2024-10-10T15:29:44.509458Z · JSON