{"id":"GHSA-jv8m-2544-3pg3","summary":"Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe =\u003e ['all']`","details":"### Description\n\nSeveral filters in the `twig/*` extras packages are registered with `is_safe =\u003e ['all']`, which tells Twig's autoescaper to treat their output as safe in every context (`html`, `js`, `css`, `url`, ...). The output of these filters is plain text or HTML markup, neither of which is safe in every escaping context.\n\nAffected filters:\n\n- `html_to_markdown` (`twig/markdown-extra`) emits plain Markdown text. `league/html-to-markdown` decodes HTML entities when producing code spans and fenced blocks, so an attacker-controlled `\u003ccode\u003e<img src=x onerror=alert(1)>\u003c/code\u003e` becomes `` `\u003cimg src=x onerror=alert(1)\u003e` ``, which renders live when interpolated into an HTML page.\n- `markdown_to_html` (`twig/markdown-extra`) emits HTML. Safe in an HTML context but not in JS, CSS or URL contexts (e.g. when interpolated into an inline `\u003cscript\u003e` block).\n- `inline_css` (`twig/cssinliner-extra`) emits HTML with inlined styles. Same constraint as `markdown_to_html`.\n\nIn all three cases, `is_safe =\u003e ['all']` causes the autoescaper to emit the output verbatim in any context, even when the developer never wrote `|raw`. In a context such as a JS string or a URL parameter, this produces unescaped HTML and is exploitable as XSS.\n\n### Resolution\n\n- `html_to_markdown` no longer claims to be safe in any escaping context; its plain-text output is now autoescaped for the surrounding context.\n- `markdown_to_html` and `inline_css` are now declared `is_safe =\u003e ['html']`, asserting only what they actually guarantee.\n\n### Credits\n\nTwig would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix for `html_to_markdown` and `markdown_to_html` in `twig/markdown-extra`, and Christophe Coevoet for extending the audit to `inline_css` in `twig/cssinliner-extra`.","aliases":["CVE-2026-46637"],"modified":"2026-09-10T03:51:06.308160656Z","published":"2026-05-21T21:27:20Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-05-21T21:27:20Z","nvd_published_at":null,"cwe_ids":["CWE-116"],"severity":"LOW"},"references":[{"type":"WEB","url":"https://github.com/twigphp/Twig/security/advisories/GHSA-jv8m-2544-3pg3"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/cssinliner-extra/CVE-2026-46637.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/markdown-extra/CVE-2026-46637.yaml"},{"type":"PACKAGE","url":"https://github.com/twigphp/Twig"},{"type":"WEB","url":"https://symfony.com/cve-2026-46637"}],"affected":[{"package":{"name":"twig/markdown-extra","ecosystem":"Packagist","purl":"pkg:composer/twig/markdown-extra"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0"}]}],"versions":["v2.12.0","v2.12.1","v2.12.2","v2.12.3","v2.12.4","v2.12.5","v2.13.0","v2.13.1","v2.14.0","v2.14.1","v2.14.11","v2.14.2","v2.14.3","v2.14.5","v2.14.7","v2.14.8","v2.14.9","v2.15.0","v2.15.4","v2.15.5","v2.15.6","v2.16.0","v3.0.0","v3.0.0-BETA1","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v3.0.5","v3.1.0","v3.1.1","v3.10.0","v3.11.0","v3.12.0","v3.13.0","v3.15.0","v3.16.0","v3.17.0","v3.18.0","v3.19.0","v3.2.1","v3.20.0","v3.21.0","v3.22.0","v3.23.0","v3.24.0","v3.3.0","v3.3.1","v3.3.3","v3.3.4","v3.3.5","v3.3.8","v3.4.0","v3.5.0","v3.5.1","v3.6.0","v3.7.0","v3.7.1","v3.8.0","v3.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jv8m-2544-3pg3/GHSA-jv8m-2544-3pg3.json"}},{"package":{"name":"twig/cssinliner-extra","ecosystem":"Packagist","purl":"pkg:composer/twig/cssinliner-extra"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0"}]}],"versions":["v2.12.0","v2.12.1","v2.12.2","v2.12.3","v2.12.4","v2.12.5","v2.13.0","v2.13.1","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.7","v2.14.8","v2.14.9","v2.15.0","v2.15.5","v2.15.6","v2.16.0","v3.0.0","v3.0.0-BETA1","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v3.0.5","v3.1.0","v3.1.1","v3.10.0","v3.11.0","v3.12.0","v3.13.0","v3.15.0","v3.16.0","v3.17.0","v3.18.0","v3.19.0","v3.2.1","v3.20.0","v3.21.0","v3.22.0","v3.23.0","v3.24.0","v3.3.0","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.5.0","v3.5.1","v3.6.0","v3.7.0","v3.7.1","v3.8.0","v3.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jv8m-2544-3pg3/GHSA-jv8m-2544-3pg3.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U"}]}