Cloudanix VulnDB

CVE-2026-46628

Medium · 5.4

Twig: The `spaceless` filter implicitly marks its output as safe

CVSS

5.4

EPSS

0.3%

Published

May 21, 2026

CISA due date

—

The record

The `spaceless` filter is registered with `is_safe => ['html']`, which means Twig's autoescaper does not escape its output in an HTML context. As a result, applying `spaceless` to attacker-controlled input that contains markup emits the markup unescaped even when the developer never wrote `|raw` and autoescape is enabled. Example: ```twig {% set payload = '<script>alert()</script>' %} {{ payload }} {# escaped #} {{ payload|spaceless }} {# not escaped #} ``` The filter is deprecated but still functional. With the deprecation, some downstream projects (e.g. Drupal modules) have duplicated the filter and inherited the same `is_safe` flag.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities