Cloudanix VulnDB

CVE-2026-46637

Medium · 5.4

Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

CVSS

5.4

EPSS

0.3%

Published

May 21, 2026

CISA due date

—

The record

Several filters in the `twig/*` extras packages are registered with `is_safe => ['all']`, which tells Twig's autoescaper to treat their output as safe in every context (`html`, `js`, `css`, `url`, ...). The output of these filters is plain text or HTML markup, neither of which is safe in every escaping context. Affected filters: - `html_to_markdown` (`twig/markdown-extra`) emits plain Markdown text. `league/html-to-markdown` decodes HTML entities when producing code spans and fenced blocks, so an attacker-controlled `<code>&lt;img src=x onerror=alert(1)&gt;</code>` becomes `` `<img src=x onerror=alert(1)>` ``, which renders live when interpolated into an HTML page. - `markdown_to_html` (`twig/markdown-extra`) emits HTML. Safe in an HTML context but not in JS, CSS or URL contexts (e.g. when interpolated into an inline `<script>` block). - `inline_css` (`twig/cssinliner-extra`) emits HTML with inlined styles. Same constraint as `markdown_to_html`. In all three cases, `is_safe => ['all']` causes the autoescaper to emit the output verbatim in any context, even when the developer never wrote `|raw`. In a context such as a JS string or a URL parameter, this produces unescaped HTML and is exploitable as XSS.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities