Twig: PHP code injection via `{% use %}` template name

PHP

Compiler::string() escapes ", $, \, NUL and TAB when generating PHP double-quoted string literals, but does not escape single quotes. In ModuleNode::compileConstructor(), the template name from a {% use %} tag is compiled via subcompile() -> string() and placed inside a surrounding PHP single-quoted string literal.

First seen: 21 May 2026
Last update: 21 May 2026, 21:24 UTC
Versions per GitHub advisory, not the vendor: twig/twig 3.26.0
Identifiers: CVE-2026-46633
CVSS: 9.8
Source: GitHub advisory
On the menu as: PHP

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Twig: PHP code injection via `{% use %}` template name
Severity: critical. Patch status: fix status unknown.
Affected: PHP
Versions per GitHub advisory, not the vendor: twig/twig 3.26.0
Ids: CVE-2026-46633

Compiler::string() escapes ", $, \, NUL and TAB when generating PHP double-quoted string literals, but does not escape single quotes. In ModuleNode::compileConstructor(), the template name from a {% use %} tag is compiled via subcompile() -> string() and placed inside a surrounding PHP single-quoted string literal.

## Steps
1. Search every lockfile and manifest (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock, composer.lock, go.sum, Cargo.lock, Gemfile.lock) for `twig/twig`. For each hit, compare the installed version with the version on the same major line (per GitHub advisory, not the vendor, so check the vendor's advisory before treating it as a fix): twig/twig 3.26.0. If it's lower, give the exact upgrade command for the package manager this repo uses.
2. Versions per GitHub advisory, not the vendor: twig/twig: >= 1.15.1 < 3.26.0 → 3.26.0. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| twig/twig >= 1.15.1 < 3.26.0 | per GitHub advisory, not the vendor | 3.26.0 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-46633") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-46633.yaml https://github.com/advisories/GHSA-7p85-w9px-jpjp https://github.com/twigphp/Twig/security/advisories/GHSA-7p85-w9px-jpjp https://nvd.nist.gov/vuln/detail/CVE-2026-46633 https://symfony.com/cve-2026-46633
https://pwned.coffee/i/twig-php-code-injection-via-use-template-name-cve-2026-46633

Receipt

Exploitation: No known exploitation
By release line, per GitHub advisory, not the vendor: Product Affected Version named Source
twig/twig (composer) >= 1.15.1, < 3.26.0 3.26.0 GitHub advisory per GitHub advisory, not the vendor checked 4 Nov
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (NVD) for CVE-2026-46633
Last checked: 4 Nov 2026, 00:17 UTC

Product	Affected	Version named	Source
twig/twig (composer)	>= 1.15.1, < 3.26.0	3.26.0	GitHub advisory per GitHub advisory, not the vendor checked 4 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Totalone very hot coffee