Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

twig/markdown-extra

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 1.3PackagistPublished

    Twig: HTML-output filters in twig/* extras incorrectly declared is_safe => ['all']

    CVE-2026-46637 · GHSA-jv8m-2544-3pg3

    Affected
    • Packagist twig/markdown-extra < 3.26.0
    Fixed in
    3.26.0· Vendor fix available
    Issue
    Several filters in the twig/ extras packages are registered with issafe = ['all'], which tells Twig's autoescaper to treat their output as safe in every context (html, js, css, url, ...). The output of these filters is plain text or HTML markup, neither of which is safe in every escaping context. Affected filters: - htmltomarkdown (twig/markdown-extra) emits plain Markdown text. league/html-to-markdown decodes HTML entities when producing code spans and fenced blocks, so an attacker-controlled <code&lt;img src=x onerror=alert(1)&gt;</code becomes <img src=x onerror=alert(1) , which renders live when interpolated into an HTML page. - markdowntohtml (twig/markdown-extra) emits HTML. Safe in an HTML context but not in JS, CSS or URL contexts (e.g. when interpolated into an inline <script block). - inlinecss (twig/cssinliner-extra) emits HTML with inlined styles. Same constraint as markdowntohtml. In all three cases, issafe = ['all'] causes the autoescaper to emit the output…

    Recommended action: Upgrade to 3.26.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →