Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
The advisory, in context
Description
When the sandbox is enabled selectively via SourcePolicyInterface (and not globally), a sandboxed template that is allowed to call template_from_string and include can render an arbitrary inner template with no security policy enforcement.
Environment::createTemplate() compiles the inner string under a synthesized name (__string_template__<hash>), so a name/path-based SourcePolicy returns false for it, and the inner template's checkSecurity() becomes a no-op. From a template the integrator believes is sandboxed, an attacker can use any tag/filter/function (including constant() to read secrets, or |map("system") to execute shell commands).
Resolution
This is a configuration trap rather than a code bug: there is no legitimate use case for exposing template_from_string to untrusted template authors, and propagating the parent sandbox state through template_from_string would require invasive changes to SourcePolicyInterface semantics with their own risks.
Starting with Twig 3.26.0, the documentation and the PHPDoc of StringLoaderExtension::templateFromString() explicitly warn against allowing template_from_string in a sandboxed environment (i.e. listing it in a SecurityPolicy allowed-functions list). Integrators using a SourcePolicyInterface MUST NOT allow template_from_string in their allowed functions; the safest option is not to register StringLoaderExtension at all when a sandbox is in use.
Credits
Twig would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 3.9.0 before 3.26.0
Fixed in 3.26.0
32 explicitly affected versions
v3.10.0, v3.10.1, v3.10.2, v3.10.3, v3.11.0, v3.11.1, v3.11.2, v3.11.3, v3.12.0, v3.13.0, v3.14.0, v3.14.1, v3.14.2, v3.15.0, v3.16.0, v3.17.0, v3.17.1, v3.18.0, v3.19.0, v3.20.0, v3.21.0, v3.21.1, v3.22.0, v3.22.1, v3.22.2, v3.23.0, v3.24.0, v3.25.0, v3.9.0, v3.9.1, v3.9.2, v3.9.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.9.0"
},
{
"fixed": "3.26.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v3.10.0",
"v3.10.1",
"v3.10.2",
"v3.10.3",
"v3.11.0",
"v3.11.1",
"v3.11.2",
"v3.11.3",
"v3.12.0",
"v3.13.0",
"v3.14.0",
"v3.14.1",
"v3.14.2",
"v3.15.0",
"v3.16.0",
"v3.17.0",
"v3.17.1",
"v3.18.0",
"v3.19.0",
"v3.20.0",
"v3.21.0",
"v3.21.1",
"v3.22.0",
"v3.22.1",
"v3.22.2",
"v3.23.0",
"v3.24.0",
"v3.25.0",
"v3.9.0",
"v3.9.1",
"v3.9.2",
"v3.9.3"
]
}