Twig: XSS in profiler HtmlDumper via unescaped template and profile names
The advisory, in context
Description
Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() straight into its HTML output without escaping:
protected function formatTemplate(Profile $profile, $prefix): string
{
return \sprintf('%s└ <span style="background-color: %s">%s</span>', $prefix, self::$colors['template'], $profile->getTemplate());
}
The template name comes from the loader (the array key for ArrayLoader, a row id for a database-backed loader, etc.). When that name is attacker-controlled, the profiler dump emits arbitrary HTML, and any browser that renders it executes the injected markup. This is an output-encoding bug in profiler/debug tooling, not a sandbox escape.
Resolution
HtmlDumper now runs both Profile::getTemplate() and Profile::getName() through htmlspecialchars() before inserting them into the HTML output.
Credits
Twig would like to thank El Kharoubi Iosif for reporting the issue and Nicolas Grekas for fixing it.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 3.0.0 before 3.26.0
Fixed in 3.26.0
63 explicitly affected versions
v3.0.0, v3.0.1, v3.0.2, v3.0.3, v3.0.4, v3.0.5, v3.1.0, v3.1.1, v3.10.0, v3.10.1, v3.10.2, v3.10.3, v3.11.0, v3.11.1, v3.11.2, v3.11.3, v3.12.0, v3.13.0, v3.14.0, v3.14.1, v3.14.2, v3.15.0, v3.16.0, v3.17.0, v3.17.1, v3.18.0, v3.19.0, v3.2.1, v3.20.0, v3.21.0, v3.21.1, v3.22.0, v3.22.1, v3.22.2, v3.23.0, v3.24.0, v3.25.0, v3.3.0, v3.3.1, v3.3.10, v3.3.2, v3.3.3, v3.3.4, v3.3.5, v3.3.6, v3.3.7, v3.3.8, v3.3.9, v3.4.0, v3.4.1, v3.4.2, v3.4.3, v3.5.0, v3.5.1, v3.6.0, v3.6.1, v3.7.0, v3.7.1, v3.8.0, v3.9.0, v3.9.1, v3.9.2, v3.9.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.26.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v3.0.0",
"v3.0.1",
"v3.0.2",
"v3.0.3",
"v3.0.4",
"v3.0.5",
"v3.1.0",
"v3.1.1",
"v3.10.0",
"v3.10.1",
"v3.10.2",
"v3.10.3",
"v3.11.0",
"v3.11.1",
"v3.11.2",
"v3.11.3",
"v3.12.0",
"v3.13.0",
"v3.14.0",
"v3.14.1",
"v3.14.2",
"v3.15.0",
"v3.16.0",
"v3.17.0",
"v3.17.1",
"v3.18.0",
"v3.19.0",
"v3.2.1",
"v3.20.0",
"v3.21.0",
"v3.21.1",
"v3.22.0",
"v3.22.1",
"v3.22.2",
"v3.23.0",
"v3.24.0",
"v3.25.0",
"v3.3.0",
"v3.3.1",
"v3.3.10",
"v3.3.2",
"v3.3.3",
"v3.3.4",
"v3.3.5",
"v3.3.6",
"v3.3.7",
"v3.3.8",
"v3.3.9",
"v3.4.0",
"v3.4.1",
"v3.4.2",
"v3.4.3",
"v3.5.0",
"v3.5.1",
"v3.6.0",
"v3.6.1",
"v3.7.0",
"v3.7.1",
"v3.8.0",
"v3.9.0",
"v3.9.1",
"v3.9.2",
"v3.9.3"
]
}