CVE-2026-46628: Twig: The `spaceless` filter implicitly marks its output as safe
Description
The spaceless filter is registered with issafe => ['html'], which means Twig's autoescaper does not escape its output in an HTML context. As a result, applying spaceless to attacker-controlled input that contains markup emits the markup unescaped even when the developer never wrote |raw and autoescape is enabled.
Example:
twig {% set payload = '<script>alert()</script>' %} {{ payload }} {# escaped #} {{ payload|spaceless }} {# not escaped #}
The filter is deprecated but still functional. With the deprecation, some downstream projects (e.g. Drupal modules) have duplicated the filter and inherited the same issafe flag.
Resolution
The spaceless filter no longer marks its output as safe. Documentation has been updated to warn that spaceless should not be applied to unsanitised user input.
Credits
Twig would like to thank Pierre Rudloff for reporting the issue.
Other sources
Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/twig/twigto a version that resolves this vulnerability.Fixed in 3.26.0 - Upgrade
Upgrade
Twigto a version that resolves this vulnerability.Fixed in 3.26.0 - Configuration
Update templates so the `spaceless` filter is not applied to unsanitised user input, since documentation was updated to warn against this. (Example from the material shows `{% set payload = '<script>alert()</script>' %}` rendered unescaped when using `{{ payload|spaceless }}` with attacker-controlled markup.)
Twig (spaceless filter usage) Use of spaceless filter on unsanitised user input = Do not apply spaceless to unsanitised/attacker-controlled input
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46628?
The severity of CVE-2026-46628 is medium with a CVSS score of 5.1.
How do I fix CVE-2026-46628?
To fix CVE-2026-46628, ensure that you properly escape user input or avoid using the `spaceless` filter with untrusted data.
What vulnerabilities does CVE-2026-46628 introduce?
CVE-2026-46628 introduces a risk of cross-site scripting (XSS) attacks by allowing unescaped HTML output.
Which software is affected by CVE-2026-46628?
CVE-2026-46628 affects the Twig template engine and Symfony Twig.
When was CVE-2026-46628 published and last modified?
CVE-2026-46628 was published on May 21, 2026, and last modified on July 16, 2026.