Twig CVE-2025-24374: Missing output escaping for the null coalesce operator
Affected versions
Twig versions >=3.16.0,<3.19.0 are affected by this security issue.
The issue has been fixed in Twig 3.19.0.
Description
When using the null coalesce operator (??), output escaping was missing for the expression on the left side of the operator.
Resolution
Output escaping for the ?? operator has been fixed.
The patch for this issue is available here for the 3.x branch.
Credits
We would like to thank Phil E. Taylor for reporting the issue and Fabien Potencier for providing the fix.
Sponsor the Symfony project.
Symfony Blog