Affected versions
Twig versions >=3.16.0,<3.19.0 are affected by this security issue.
The issue has been fixed in Twig 3.19.0.
Description
When using the null coalesce operator (??
), output escaping was missing for the expression on the left side of the operator.
Resolution
Output escaping for the ??
operator has been fixed.
The patch for this issue is available here for the 3.x branch.