A critical security vulnerability (CVE-2026-46633) in Twig templating engine (versions below 3.26.0) allows PHP code injection via the `{% use %}` tag. The `Compiler::string()` method failed to escape single quotes, enabling a malicious template name to break out of a surrounding PHP single-quoted string literal and inject arbitrary PHP code into the compiled cache file. The injected code executes on cache load, bypassing the Twig sandbox entirely — including in sandboxed templates since `SecurityPolicy` unconditionally allows `{% use %}`. The fix in Twig 3.26.0 adds single-quote escaping in `Compiler::string()`.
