Search for vulnerabilities
Vulnerability details: VCID-272f-nexb-tqe8
Vulnerability ID VCID-272f-nexb-tqe8
Aliases CVE-2025-24374
GHSA-3xg3-cgvq-2xwr
Summary Twig security issue where escaping was missing when using null coalesce operator When using the `??` operator, output escaping was missing for the expression on the left side of the operator.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
System Score Found at
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-24374
cvssv3.1 4.3 https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2025-24374.yaml
generic_textual MODERATE https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2025-24374.yaml
cvssv3.1 4.3 https://github.com/twigphp/Twig
generic_textual MODERATE https://github.com/twigphp/Twig
cvssv3.1 4.3 https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
generic_textual MODERATE https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
ssvc Track https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
cvssv3.1 4.3 https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
generic_textual MODERATE https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
ssvc Track https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2025-24374
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-24374
cvssv3.1 4.3 https://symfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operator
generic_textual MODERATE https://symfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operator
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-24374
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24374
https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2025-24374.yaml
https://github.com/twigphp/Twig
https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
https://nvd.nist.gov/vuln/detail/CVE-2025-24374
https://symfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operator
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2025-24374.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://github.com/twigphp/Twig
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-29T15:44:45Z/ Found at https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-29T15:44:45Z/ Found at https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-24374
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://symfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operator
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.06908
EPSS Score 0.0003
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:12:24.625841+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-3xg3-cgvq-2xwr/GHSA-3xg3-cgvq-2xwr.json 36.1.3