Security Advisory
CVE-2026-46628
5.4
MEDIUM
Vulnerability Description
Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.
Published Date
July 14, 2026
Official Source
NIST NVD Advisory