GHSA-3xg3-cgvq-2xwr
Twig security issue where escaping was missing when using null coalesce operator
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
When using the `??` operator, output escaping was missing for the expression on the left side of the operator.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
- https://nvd.nist.gov/vuln/detail/CVE-2025-24374
- https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2025-24374.yaml
- https://github.com/twigphp/Twig
- https://symfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operator