CVE-2024-51754 json
Unguarded calls to __toString() when nesting an object into an array in Twig
published 2024-11-06 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-3201 , GHSA-6377-hfv9-hqf6
- cvss
- 2.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.
Patch / fix
- packagist twig/twig 3.11.2, 3.14.1
- symfony twig 3.11.2, 3.14.1
- php-twig Debian 12 3.5.1-1+deb12u3
- php-twig Debian 14, Debian 13 3.14.2-1
debian advisories DEBIAN-CVE-2024-51754
- php-twig Ubuntu Pro 20.04 LTS 2.12.5-1ubuntu0.1~esm2
- php-twig Ubuntu Pro 22.04 LTS 3.3.8-2ubuntu4+esm2
- php-twig Ubuntu Pro 24.04 LTS 3.8.0-2ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2024-51754
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.2 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 2.2 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | twig/twig | <3.11.2 >=3.12, <3.14.1 |
3.11.2 3.14.1 |
Affected products
- twigphp Twig
Classification
- Weakness
-
- CWE-668 Exposure of Resource to Wrong Sphere
References
-
github.com
/twigphp/Twig/commit/2bb8c2460a2c519c498df9b643d5277117155a73
web
-
github.com
/twigphp/Twig/security/advisories/GHSA-6377-hfv9-hqf6
web
-
lists.debian.org
/debian-lts-announce/2025/05/msg00039.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-51754
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2024-51754.yaml
web
-
github.com
/twigphp/Twig
package
-
symfony.com
/blog/unguarded-calls-to-__tostring-when-nesting-an-object-into-an-array
web
Sources
- CVE List CVE-2024-51754
- GitHub Advisory GHSA-6377-hfv9-hqf6
- NVD CVE-2024-51754
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.