{"id":"GHSA-2g2g-8p8h-fgwm","aliases":["CVE-2026-47730"],"title":"Twig: XSS in profiler HtmlDumper via unescaped template and profile names","description":"### Description\n\n`Twig\\Profiler\\Dumper\\HtmlDumper` writes `Profile::getTemplate()` and `Profile::getName()` straight into its HTML output without escaping:\n\n```php\nprotected function formatTemplate(Profile $profile, $prefix): string\n{\n    return \\sprintf('%s└ <span style=\"background-color: %s\">%s</span>', $prefix, self::$colors['template'], $profile->getTemplate());\n}\n```\n\nThe template name comes from the loader (the array key for `ArrayLoader`, a row id for a database-backed loader, etc.). When that name is attacker-controlled, the profiler dump emits arbitrary HTML, and any browser that renders it executes the injected markup. This is an output-encoding bug in profiler/debug tooling, not a sandbox escape.\n\n### Resolution\n\n`HtmlDumper` now runs both `Profile::getTemplate()` and `Profile::getName()` through `htmlspecialchars()` before inserting them into the HTML output.\n\n### Credits\n\nTwig would like to thank El Kharoubi Iosif for reporting the issue and Nicolas Grekas for fixing it.","severity":"low","score":null,"published":"2026-06-05T21:46:26.000Z","modified":"2026-09-10T03:51:07.469Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"twig/twig","ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.26.0"}],"type":"ECOSYSTEM"}],"versions":["v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v3.0.5","v3.1.0","v3.1.1","v3.10.0","v3.10.1","v3.10.2","v3.10.3","v3.11.0","v3.11.1","v3.11.2","v3.11.3","v3.12.0","v3.13.0","v3.14.0","v3.14.1","v3.14.2","v3.15.0","v3.16.0","v3.17.0","v3.17.1","v3.18.0","v3.19.0","v3.2.1","v3.20.0","v3.21.0","v3.21.1","v3.22.0","v3.22.1","v3.22.2","v3.23.0","v3.24.0","v3.25.0","v3.3.0","v3.3.1","v3.3.10","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.3.6","v3.3.7","v3.3.8","v3.3.9","v3.4.0","v3.4.1","v3.4.2","v3.4.3","v3.5.0","v3.5.1","v3.6.0","v3.6.1","v3.7.0","v3.7.1","v3.8.0","v3.9.0","v3.9.1","v3.9.2","v3.9.3"],"fixed":["3.26.0"]}],"references":["https://github.com/twigphp/Twig/security/advisories/GHSA-2g2g-8p8h-fgwm","https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-47730.yaml","https://github.com/twigphp/Twig","https://github.com/twigphp/Twig/releases/tag/v3.26.0","https://symfony.com/cve-2026-47730"],"sources":[{"name":"OSV","id":"GHSA-2g2g-8p8h-fgwm","modified":"2026-09-10T03:51:07.469938305Z","url":"https://osv.dev/vulnerability/GHSA-2g2g-8p8h-fgwm"}],"assessments":[]}