Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| twig/twig | composer | <= 3.26.0 | 3.27.0 |
Miggo AIRoot Cause AnalysisThe security vulnerability is a bypass of the Twig sandbox's __toString() policy. The root cause was located in the Twig\Node\Expression\ArrayExpression::compile method. This method is responsible for compiling array declarations in a Twig template into executable PHP code.
Before the patch, the compile method did not properly handle cases where an object was used as a dynamic key in an array. It failed to ensure that the sandbox's security checks were applied before the object was converted to a string to be used as an array key. This resulted in a direct call to the object's __toString() method by the PHP engine, bypassing the sandbox's ensureToStringAllowed() check.
The fix addresses this by making ArrayExpression implement the CoercesChildrenToStringInterface. This interface, along with the newly added getStringCoercedChildNames method, signals to the sandbox visitor that dynamic keys need to be wrapped in a CheckToStringNode. This ensures that the sandbox policy is checked before any __toString() call is made at runtime. The compile method itself was also modified to explicitly cast the (now policy-checked) key to a string, preserving PHP's type requirements for array keys while closing the security hole.
Twig\Node\Expression\ArrayExpression::compilesrc/Node/Expression/ArrayExpression.php