Skip to main content

Protection Mechanism Failure

CVE-2026-46639

High
8.7/10

Summary

The object-destructuring assignment syntax introduced in Twig 3.24.0 prior to 3.26.0 generates a call to `CoreExtension::getAttribute()` with the `$sandboxed` argument hardcoded to `false`, regardless of whether a `SandboxExtension` is active. This permanently disables the sandbox's property and method policy checks for every destructuring expression.

CWE-693 - Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

References

Advisory Timeline

  • Published