CVE-2025-24374

Twig fixes a security issue where escaping was missing when using null coalesce operator (??)

State: Published
Severity: 4.3 Medium
Published: Jan 29, 2025
Updated: Jan 29, 2025
Reserved: Jan 20, 2025

Description

Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	GitHub_M

Weaknesses

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected Products

Product	Versions
Twigtwigphp	>= 3.16.0, < 3.19.0Affected

References

https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.