Twig CVE-2024-51754: Unguarded calls to __toString() in a sandbox when an object is in an array or an argument list

Affected versions

Twig versions <3.11.2; >=3.12,<3.14.1 are affected by this security issue.

The issue has been fixed in Twig 3.11.2 and 3.14.1. Note that Twig versions 1 and 2 are not maintained anymore and are vulnerable.

Description

In a sandbox,… https://symfony.com/blog/cve-2024-51754-unguarded-calls-to-tostring-in-a-sandbox-when-an-object-is-in-an-array-or-an-argument-list?utm_source=Symfony%20Blog%20Feed&utm_medium=feed

Utworzony 6mo | 6 lis 2024, 19:50:23


Zaloguj się, aby dodać komentarz

Inne posty w tej grupie

A Week of Symfony #955 (April 14–20, 2025)

This week, the upcoming Symfony 7.3 version improved the AsAlias attribute by adding a new argument, introduced Clock support for UriSigner, and refined the return type of the ContainerInterface::get(

20 kwi 2025, 08:30:06 | Symfony
SymfonyOnline June 2025: Rethinking File Handling in Symfony

SymfonyOnline June 2025 is almost here, starting in almost 2 months on:

June 10-11: Workshop days. It is possible to attend 1 two-day training or 2 one-day trainings. June 12-13: Online confe

16 kwi 2025, 16:30:02 | Symfony
SymfonyLive Paris 2025: Recap and replay!

SymfonyLive Paris 2025 took place three weeks ago — a big thank you to everyone who joined us! The conference was held entirely in French, and now you can relive the best moments: replays, hig

15 kwi 2025, 14:50:24 | Symfony
A Week of Symfony #954 (April 7–13, 2025)

This week, Symfony 7.3 entered its "feature freeze" period in preparation for its release at the end of May 2025. Development activity focused on refining and polishing its new features, including a n

13 kwi 2025, 09:40:02 | Symfony
SymfonyOnline June 2025: What's New in Symfony 7.3

SymfonyOnline June 2025 is almost here, starting in almost 2 months on:

June 10-11: Workshop days. It is possible to attend 1 two-day training or 2 one-day trainings. June 12-13: Online confe

10 kwi 2025, 16:40:34 | Symfony
SymfonyCon Amsterdam 2025: Last days to enjoy early bird tickets!

The international Symfony conference of the year, SymfonyCon Amsterdam 2025, will take place in the Netherlands on November 27 & 28, 2025!

⏳ Early bird registration ends this Wednesday! D

8 kwi 2025, 09:10:13 | Symfony
A Week of Symfony #953 (March 31 – April 6, 2025)

This week, the upcoming Symfony 7.3 version entered its feature freeze period to tweak and polish its new features before releasing it at the end of May 2025. In addition, we celebrated the SymfonyLiv

6 kwi 2025, 08:30:10 | Symfony