Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| twig/twig(Packagist) | 3.16.0 | 3.19.0 | N/A |
CVSS Metrics
