HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

The Symfony Blog provides updates, tutorials, and insights on Symfony, a popular PHP framework for building web applications. Covering topics such as framework features, best practices, and community updates, the blog offers resources for Symfony developers looking to enhance their skills and stay up-to-date with the latest developments in the Symfony ecosystem. Developers can learn how to leverage Symfony's powerful features and conventions to build robust and maintainable web applications that meet the demands of modern web development.

Symfony

A security vulnerability (CVE-2026-46637) was discovered in Twig's extra packages where the `html_to_markdown`, `markdown_to_html`, and `inline_css` filters were incorrectly declared with `is_safe => ['all']`. This caused Twig's autoescaper to treat their output as safe in every context, including JS, CSS, and URL contexts, enabling XSS attacks. The fix in Twig 3.26.0 narrows the safety declarations: `html_to_markdown` is no longer marked safe in any context, while `markdown_to_html` and `inline_css` are now correctly declared `is_safe => ['html']` only.

CVE-2026-46637: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` (Symfony Blog)