Nixpkgs security tracker
8.7 HIGH
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): High (H)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): None (N)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): High (H)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): None (N)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
Activity log
- Created suggestion
Twig: Sandbox method allowlist bypass via `Markup` subclass
Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a Markup-derived class into a sandboxed template (typically to mark a chunk of HTML as safe) inadvertently exposes every public method of that subclass to template authors, regardless of the configured allowedMethods list. This issue has been patched in version 3.27.0.
References
-
https://github.com/twigphp/Twig/security/advisories/GHSA-64jr-qjx4-w2fh x_refsource_CONFIRM
-
https://security-tracker.debian.org/tracker/CVE-2026-46636 x_refsource_MISC
-
https://security-tracker.debian.org/tracker/DSA-6311-1 x_refsource_MISC
-
http://github.com/twigphp/Twig/releases/tag/v3.27.0 x_refsource_MISC
Affected products
- ==>= 1.0.0, < 3.27.0
Matching in nixpkgs
pkgs.twiggy
Code size profiler for Wasm
pkgs.ludtwig
Linter / Formatter for Twig template files which respects HTML and your time
pkgs.bitwig-studio
Digital audio workstation
pkgs.bitwig-studio3
Digital audio workstation
pkgs.bitwig-studio4
Digital audio workstation
pkgs.bitwig-studio5
None
pkgs.bitwig-studio6
Digital audio workstation
pkgs.perlPackages.Twiggy
AnyEvent HTTP server for PSGI
pkgs.perl5Packages.Twiggy
AnyEvent HTTP server for PSGI
pkgs.perlPackages.XMLTwig
Perl module for processing huge XML documents in tree mode
pkgs.twig-language-server
Language server for Twig templates
pkgs.perl5Packages.XMLTwig
Perl module for processing huge XML documents in tree mode
pkgs.bitwig-studio5-unwrapped
Digital audio workstation
pkgs.python313Packages.twiggy
Twiggy is the first totally new design for a logger since log4j
pkgs.python314Packages.twiggy
Twiggy is the first totally new design for a logger since log4j
pkgs.tree-sitter-grammars.tree-sitter-twig
Tree-sitter grammar for twig
pkgs.vimPlugins.nvim-treesitter-parsers.twig
Tree-sitter grammar for twig
-
nixos-unstable -
- nixos-unstable-small 0.0.0+rev=2208d2a
-
nixos-26.05 -
- nixos-26.05-small 0.0.0+rev=7195ee5
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-twig
Python bindings for tree-sitter-twig
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-twig
Python bindings for tree-sitter-twig
Package maintainers
-
@eleinah Eleina Mironia <ellie@eleina.dev>
-
@michalrus Michal Rus <m@michalrus.com>
-
@mrVanDalo Ingolf Wanger <contact@ingolf-wagner.de>
-
@bfortz Bernard Fortz <bernard.fortz@gmail.com>
-
@MalteJanz Malte Janz <service.malte.j@protonmail.com>
-
@A-jay98 Ali Jamadi <ali@jamadi.me>
-
@stepbrobd Yifei Sun <ysun@hey.com>
-
@adfaure Adrien Faure <adfaure@pm.me>
-
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
-
@nbp Nicolas B. Pierron <nixos@nbp.name>
-
@genga898 Emmanuel Genga <genga898@gmail.com>
-
@lucperkins Luc Perkins <lucperkins@gmail.com>