CVE-2026-47730

Name of the Vulnerable Software and Affected Versions Twig (affected versions not specified)

Description The TwigProfilerDumperHtmlDumper component fails to escape the output of Profile::getTemplate() and Profile::getName() when writing to HTML. If an attacker can control the template name—which may originate from an ArrayLoader array key or a database-backed loader row ID—they can inject arbitrary HTML. This results in the browser executing the injected markup when rendering the profiler dump. This is an output-encoding issue within the profiler and debug tooling.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.