medium4.3
CVE-2025-24374
Twig security issue where escaping was missing when using null coalesce operator
Impact
When using the `??` operator, output escaping was missing for the expression on the left side of the operator.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | twig/twig | >= 3.16.0, < 3.19.0 | 3.19.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
- https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
- https://github.com/advisories/GHSA-3xg3-cgvq-2xwr
- https://nvd.nist.gov/vuln/detail/CVE-2025-24374
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2025-24374.yaml
- https://symfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operator