Skip to content
Threat Feed
Subscribe

Vendor

Twig Project

1 brief RSS
high advisory

Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

A high-severity vulnerability, CVE-2026-49981, in the Twig templating engine allows for a sandbox bypass when the sandbox state changes between renders for a cached `Template` instance, enabling the execution of otherwise restricted filters, tags, and functions in sandboxed contexts.

Twig vulnerability sandbox-bypass web-application rce
2t