CVE-2025-24374CWE-74

Twig fixes a security issue where escaping was missing when using null coalesce operator (??)

Medium · published January 29, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00290 · 20.4th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2025-01-29T15:22Z
EPSS history
Timeline
  • 29 JAN 15:22Z
    Twig fixes a security issue where escaping was missing when using null coalesce operator (??)
    cvelistv5