PT-2026-42171 · Drupal+1 · Drupal+1

Published 2026-05-20 · Updated 2026-05-21 · CVE-2026-46628

Positive Technologies (AI Summary)

CVSS v4.0

1.3

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Twig (affected versions not specified)

Description The spaceless filter is registered with is safe => ['html'], causing Twig's autoescaper to skip escaping its output in HTML contexts. This allows attacker-controlled input containing markup to be emitted unescaped, even when autoescape is enabled and the |raw filter is not used. This filter is deprecated but remains functional, and some downstream projects, such as Drupal modules, have duplicated the filter and inherited the same behavior.

Recommendations Update to a version where the spaceless filter no longer marks its output as safe. Avoid applying the spaceless filter to unsanitized user input.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2026-46628

GHSA-4J38-F5CW-54H7

Affected Products

Drupal

Twig

References · 12

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-46628.yaml · Exploit
• https://ubuntu.com/security/CVE-2026-46628 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-46628 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-46628 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-46628 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-46628 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4j38-f5cw-54h7 · Vendor Advisory
• https://github.com/twigphp/Twig · Note
• https://github.com/twigphp/Twig/security/advisories/GHSA-4j38-f5cw-54h7 · Note
• https://symfony.com/blog/cve-2026-46628-the-spaceless-filter-implicitly-marks-its-output-as-safe · Note
• https://symfony.com/cve-2026-46628 · Note
• https://twitter.com/symfony/status/2057046510148235720 · Twitter Post