CVE-2026-46639

Name of the Vulnerable Software and Affected Versions Twig versions 3.24.0 through 3.24.x

Description The object-destructuring assignment syntax generates a call to the getAttribute() function within CoreExtension where the $sandboxed argument is hardcoded to false. This occurs regardless of whether a SandboxExtension is active, effectively disabling property and method policy checks for all destructuring expressions. Specifically, the compile() function in ObjectDestructuringSetBinary fails to pass the active sandbox flag, unlike the compile() function in GetAttrExpression.

An attacker with write access to a sandboxed template can bypass SecurityPolicy restrictions to read any public property or invoke any public getter on objects passed to the template engine. This is possible if the {% do %} tag is included in allowedTags.

Recommendations Update to a version where the destructuring compiler forwards the active sandbox flag to getAttribute() to ensure property and method allowlists are enforced.