Twig: Sandbox property and method bypass via object-destructuring assignment
Description
The object-destructuring assignment syntax introduced in Twig 3.24.0 generates a call to CoreExtension::getAttribute() with the $sandboxed argument hardcoded to false, regardless of whether a SandboxExtension is active. This permanently disables the sandbox's property and method policy checks for every destructuring expression.
ObjectDestructuringSetBinary::compile() emits:
CoreExtension::getAttribute($this->env, $this->source, ..., \Twig\Template::ANY_CALL, false, false, false, ...);
// ^^^^^
// sandbox check never runsWhereas GetAttrExpression::compile() correctly passes $env->hasExtension(SandboxExtension::class).
An attacker with write access to a sandboxed Twig template can read any public property or invoke any public getter on objects passed to the template engine, bypassing SecurityPolicy restrictions. The exploit requires only the {% do %} tag to be in allowedTags, which is a common configuration.
Resolution
The destructuring compiler now forwards the active sandbox flag to getAttribute() so property/method allowlists are enforced.
Credits
Twig would like to thank Anvil Secure in collaboration with Claude and Anthropic Research for reporting and fixing the issue.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | twig/twig | >= 3.24.0, < 3.26.0 | 3.26.0 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-693- Platform
- Composer
- Package
twig/twig- Disclosed
- 21.05.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-mm6w-gr99-p3jj - CC BY 4.0
Vulnerability history: twig/twig
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 24
- First → latest
- 02.2022 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 8
- Medium 8
- Low 7
Disclosures per year
- 2022: 4
- 2023: 0
- 2024: 4
- 2025: 1
- 2026: 15
-
Twig: Sandbox property and method bypass via object-destructuring assignment this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.