Changes.Watch~ upgrade verdicts ~
Free digest
Research1 in 10 popular npm releases needed a hotfix

critical vulnerability

Twig: PHP code injection via `{% use %}` template name

Fix availableCritical · CVSS 9.3EPSS 0.69%

Published May 21, 2026 · updated Nov 4, 2026

What to do

  1. Upgrade to a fixed version: twig/twig 3.26.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Composertwig/twig

Vulnerable versions
>= 1.15.1, < 3.26.0
Fixed in
3.26.0

Check your project: composer show twig/twig

Sources

CWE-94 Improper Control of Generation of Code

← All critical vulnerabilities