CVE-2024-51754

What it actually does

The flaw permits bypassing Twig sandbox security policies to invoke __toString() on objects when those objects appear inside arrays or as arguments to functions/filters.

Why it matters to the business

Applications relying on Twig sandboxing for untrusted templates face a risk of limited unauthorized data exposure through policy evasion, though the low severity and absence from known exploitation lists reduce immediate operational disruption.

How an attack unfolds

An attacker supplies a crafted template input that places a restricted object inside an array or argument list passed to a function or filter; the sandbox incorrectly allows the __toString() method to execute despite the security policy.

How to fix it

Upgrade twigphp/twig to version 3.11.2 or 3.14.1; the fixes are present in commit 5b580ec1882b54c98cbd8c0f8a3ca5d1904db6b1 and later releases.

How to confirm the fix worked

Confirm the installed Twig version meets or exceeds 3.11.2 or 3.14.1, then re-test the sandbox policy with objects placed inside arrays and argument lists to verify __toString() is now blocked.

Typical attack path

1. Locate a Twig template rendered inside a sandbox with a restrictive security policy
2. Craft input that embeds a policy-restricted object inside an array or as a function/filter argument
3. Trigger template rendering that processes the array or argument list
4. Observe the unintended __toString() invocation and resulting side effects

How to detect it

Examine application and template-rendering logs for repeated or anomalous processing of arrays containing objects in sandbox contexts; look for unexpected string conversions or method calls that policy rules should have prevented.

What your security team should do

• Upgrade all Twig installations to the patched versions without delay
• Audit existing sandbox policies and template inputs that pass arrays or arguments
• Add automated version checks and regression tests for sandbox behavior in CI pipelines