CVE-2026-46634 is a protection mechanism failure in Twig, the PHP template language, scored CVSS 9.8. In certain sandbox setups, an inner template can run without security policy checks. Twig 3.26.0 is the fixed release, and you should also keep template_from_string out of any sandbox.
What's affected
The GitHub advisory GHSA-24x9-r6q4-q93w lists Twig from 3.9.0 up to, but not including, 3.26.0. The patched version is 3.26.0. Other branches are not listed in the advisory I read.
The condition is narrow. The sandbox must be enabled through a source policy, not globally, and a sandboxed template must be able to call template_from_string and include.
How to check if you're exposed
- Run
composer show twig/twigto read your version. - Search your code for
SourcePolicyInterfaceorsetSourcePolicy. If you never use a source policy sandbox, this issue does not apply in the way the advisory describes. - Search for
StringLoaderExtensionand for template_from_string in your sandbox allowed functions list.
What to do now
- Upgrade twig/twig to 3.26.0 or later.
- Remove template_from_string from the sandbox's allowed functions.
- Per the advisory, the safest choice is not to register StringLoaderExtension at all when a sandbox is in use.
- Review which templates are treated as sandboxed and who can author them.
The advisory calls this a configuration trap and not a code bug. It says the 3.26.0 fix mainly adds documentation and warnings, so the workaround matters even after you upgrade.
Why it matters
The class is CWE-693, protection mechanism failure. Per the advisory, the inner template is compiled under a made up name, so a policy that decides by template name or path returns false for it, and the security check does nothing. A sandbox that quietly stops applying is worse than none, because people trust it.
The KEV flag is false and no exploitation is reported.
Quick check
Does upgrading alone close the gap?
The advisory says the fix adds documentation and warnings, and recommends the configuration workaround in any case. Do both.
Sources
Last reviewed: 19 October 2026.
