Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| twig/twig | composer | <= 3.26.0 | 3.27.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the column filter, implemented as the static method Twig\Extension\CoreExtension::column. The patch to fix the vulnerability is located entirely within this function. The vulnerability is a sandbox bypass that occurs when sandboxing is enabled via a SourcePolicyInterface. The column function would call SandboxExtension::checkPropertyAllowed but would not pass the Source object. This caused checkPropertyAllowed to incorrectly determine that the code was not running in a sandbox, thus bypassing the property allowlist. An attacker could exploit this by crafting a template that uses the column filter to access unauthorized properties of objects. The fix involves changing CoreExtension::column to get the security policy directly and call its checkPropertyAllowed method, ensuring the check is performed correctly within the context of the SourcePolicyInterface.
Twig\Extension\CoreExtension::columnsrc/Extension/CoreExtension.php