Affected versions
Twig versions >=3.16.0,<3.19.0 are affected by this security issue.
The issue has been fixed in Twig 3.19.0.
Description
When using the null coalesce operator (??), output escaping was missing for the expression on the left side of… https://symfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operator?utm_source=Symfony%20Blog%20Feed&utm_medium=feed
Login to add comment
Other posts in this group
Symfony 7.2.6 has just been released. Here is the list of the most important changes since 7.2.5:
bug #60288 [VarExporter] dump default value for property hooks if present (@xabbuh)bug #60267 [C
Symfony 7.3.0-BETA1 has just been released. Here is the list of the most important changes since 7.2:
feature #60232 Add PHP config support for routing (@fabpot)feature #60102 [HttpFoundation] A
SymfonyOnline June 2025 is almost here, starting in almost 2 months on:
June 10-11: Workshop days. It is possible to attend 1 two-day training or 2 one-day trainings. June 12-13: Online confe
Contributed by Kevin Bond in
Symfony 6.4.21 has just been released. Here is the list of the most important changes since 6.4.20:
bug #60288 [VarExporter] dump default value for property hooks if present (@xabbuh)bug #60268
Contributed by Nathan Page in
SymfonyOnline June 2025 is almost here, starting in almost 2 months on:
June 10-11: Workshop days. It is possible to attend 1 two-day training or 2 one-day trainings. June 12-13: Online confe
