Is CVE-2026-46637 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46637 being exploited in the wild.

How severe is CVE-2026-46637?

Medium severity, with a CVSS score of 4, published 14 July 2026.

Which products and versions are affected?

twig/cssinliner-extra (Packagist) < 3.26.0, ECOSYSTEM:introduced=0,fixed=3.26.0; twig/markdown-extra (Packagist) < 3.26.0, ECOSYSTEM:introduced=0,fixed=3.26.0; Twig CssInliner Extra < 3.26.0; Twig Markdown Extra < 3.26.0.

Is there a fix for CVE-2026-46637?

Yes. twig/cssinliner-extra (Packagist): upgrade to 3.26.0 or later; twig/markdown-extra (Packagist): upgrade to 3.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46637 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-46637?

Check whether you run twig/cssinliner-extra (Packagist), twig/markdown-extra (Packagist), Twig CssInliner Extra or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46637: Twig XSS in markdown-extra and cssinliner-extra filters

Q: Is there a fix for CVE-2026-46637?

Yes. twig/cssinliner-extra (Packagist): upgrade to 3.26.0 or later; twig/markdown-extra (Packagist): upgrade to 3.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46637 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-46637?

Check whether you run twig/cssinliner-extra (Packagist), twig/markdown-extra (Packagist), Twig CssInliner Extra or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46637 · Severity: medium · CVSS 4 · Published 2026-07-14

Twig, a popular template engine for PHP, contains a vulnerability in its optional markdown and CSS inliner extensions. Certain filters incorrectly tell the system that their output is safe for all parts of a webpage, including sensitive areas like JavaScript or CSS blocks. This could allow an attacker to inject malicious scripts into a website, potentially leading to unauthorized actions or data theft from users.

Vendors: Packagist.

Quick answers

Is CVE-2026-46637 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46637 being exploited in the wild.
How severe is CVE-2026-46637?: Medium severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?: twig/cssinliner-extra (Packagist) < 3.26.0, ECOSYSTEM:introduced=0,fixed=3.26.0; twig/markdown-extra (Packagist) < 3.26.0, ECOSYSTEM:introduced=0,fixed=3.26.0; Twig CssInliner Extra < 3.26.0; Twig Markdown Extra < 3.26.0.
Is there a fix for CVE-2026-46637?: Yes. twig/cssinliner-extra (Packagist): upgrade to 3.26.0 or later; twig/markdown-extra (Packagist): upgrade to 3.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46637 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-46637?: Check whether you run twig/cssinliner-extra (Packagist), twig/markdown-extra (Packagist), Twig CssInliner Extra or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

twig/cssinliner-extra (Packagist): upgrade to 3.26.0 or later
```
composer require twig/cssinliner-extra:^3.26.0
```
twig/markdown-extra (Packagist): upgrade to 3.26.0 or later
```
composer require twig/markdown-extra:^3.26.0
```

Technical details

A vulnerability exists in Twig's markdown-extra and cssinliner-extra extensions where several filters (html_to_markdown, markdown_to_html, and inline_css) were registered with the 'is_safe => [all]' attribute. This incorrectly signals to Twig's auto-escaper that the output is safe for any context, including JavaScript, CSS, and URLs. Consequently, if attacker-controlled input is processed by these filters and then placed in a sensitive context, it remains unescaped. For example, the html_to_markdown filter could decode HTML entities into live tags, and markdown_to_html could allow HTML injection into script blocks. The issue is resolved in version 3.26.0 by correctly restricting the 'is_safe' scope to 'html' or removing it to allow context-aware auto-escaping.

Affected products

twigphp Twig < 3.26.0
twig markdown-extra < 3.26.0
twig cssinliner-extra < 3.26.0

Identifiers

CVE-2026-46637
GHSA-jv8m-2544-3pg3

Timeline

2026-05-20: patched: Version 3.26.0 released
2026-05-20: advisory: GitHub Security Advisory GHSA-jv8m-2544-3pg3 published
2026-07-14: disclosed: CVE-2026-46637 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.