CVE-2024-51755

Packagist/twig/twig CVE-2024-51755: low 2.2, EPSS 0.43%

Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled

Action: Upgrade twig/twig to 3.11.2 or later.

composer require twig/twig:3.11.2

composer require twig/twig:3.14.1

Affected

Fixed versions

Sources

• osv: GHSA-jjxq-ff2g-95vh
• https://github.com/twigphp/Twig/security/advisories/GHSA-jjxq-ff2g-95vh
• https://nvd.nist.gov/vuln/detail/CVE-2024-51755
• https://github.com/twigphp/Twig/commit/831c148e786178e5f2fde9db67266be3bf241c21
• https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2024-51755.yaml
• https://github.com/twigphp/Twig
• https://symfony.com/blog/unguarded-calls-to-__isset-and-to-array-accesses-when-the-sandbox-is-enabled

CVE-2024-51755 · published 2024-11-06T19:52:55Z · modified 2024-11-12T19:45:48.742422Z · JSON