{"data":{"id":"8ad76180-7fc3-4a0e-875f-6c306137ec2c","title":"GHSA-pr2w-4gpj-cpq4: Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points","summary":"Twig's sandbox fails to enforce its policy for implicit __toString() calls in several constructs. A sandboxed template author can invoke __toString() on any object reachable in the render context, even when that class's __toString is not allowlisted. Confirmed bypass vectors include conditional expressions, the matches and loose comparison operators, Twig tests such as is empty, nested null-coalesce expressions, and the do tag and .. range operator.","solution":"The sandbox now wraps every child node that the parent will string-coerce at runtime, instead of relying on a hardcoded list of node types in SandboxNodeVisitor. A new Twig\\Node\\CoercesChildrenToStringInterface lets nodes declare which children must be guarded. Spread arguments are materialised and policy-checked via SandboxExtension::ensureSpreadAllowed(), and dynamic attribute names are checked at runtime inside CoreExtension::getAttribute().","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-pr2w-4gpj-cpq4","publishedAt":"2026-06-05T21:47:11.000Z","cveId":"CVE-2026-47732","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["twig/twig@<= 3.25.0 (fixed: 3.26.0)"],"affectedPackageNames":["twig/twig"],"affectedPackageRefs":["composer:twig/twig"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Anthropic Glasswing"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00402,"epssCheckedAt":"2026-11-05T06:10:15.770Z","kevDateAdded":null,"advisoryAliases":["GHSA-pr2w-4gpj-cpq4"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-05T21:47:11.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:34:56.054Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":null,"name":"twig/twig","fixedVersion":"3.26.0","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-10-29T21:34:55.907Z"}]}}