https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:29:14.629356+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-337873 EUVD-2026-337873 2026-10-04T00:29:14.694145+00:00 EUVD-2026-337873 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46628 fkie_cve-2026-46628 2026-10-04T00:29:14.694183+00:00

Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.

 https://cve.radiocsirt.org/vuln/ghsa-4j38-f5cw-54h7 GHSA-4j38-f5cw-54h7 — Twig: The `spaceless` filter implicitly marks its output as safe 2026-10-04T00:29:14.694215+00:00

Affected: Packagist: twig/twig

### Description

The `spaceless` filter is registered with `is_safe => ['html']`, which means Twig's autoescaper does not escape its output in an HTML context. As a result, applying `spaceless` to attacker-controlled input that contains markup emits the markup unescaped even when the developer never wrote `|raw` and autoescape is enabled.

Example:

```twig {% set payload = '<script>alert()</script>' %} {{ payload }} {# escaped #} {{ payload|spaceless }} {# not escaped #} ```

The filter is deprecated but still functional. With the deprecation, some downstream projects (e.g. Drupal modules) have duplicated the filter and inherited the same `is_safe` flag.

### Resolution

The `spaceless` filter no longer marks its output as safe. Documentation has been updated to warn that `spaceless` should not be applied to unsanitised user input.

### Credits

Twig would like to thank Pierre Rudloff for reporting the issue.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-46628 UBUNTU-CVE-2026-46628 2026-10-04T00:29:14.694252+00:00

Affected: Ubuntu:Pro:20.04:LTS: php-twig, Ubuntu:Pro:22.04:LTS: php-twig, Ubuntu:Pro:24.04:LTS: php-twig, Ubuntu:25.10: php-twig, Ubuntu:Pro:26.04:LTS: php-twig

Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.