CVE-2024-51754

LowCVSS 2.2/10Last modified Jun 17, 2026

Description

Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 2.2/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-668

Affected software

Vendor	Product	Versions
twigphp	Twig	< 3.11.2; >= 3.12.0, < 3.14.1

References

Timeline

Published: Nov 6, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-517552.2Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the s CVE-2024-517562.3The cap-std project is organized around the eponymous `cap-std` crate, and develops libraries to make it easy to write capability-based code CVE-2024-517579.3happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may e CVE-2024-517582.3Filament is a collection of full-stack components for accelerated Laravel development. All Filament features that interact with storage use CVE-2024-517597.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detlef Beyer SVT Simple svt-simple all CVE-2024-51769.4Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credential CVE-2024-517607.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ristretto Apps Dashing Memberships das CVE-2024-517617.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zackgilbert WPHelpful wphelpful allows CVE-2024-517627.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Gipple PropertyShift propertyshi CVE-2024-517637.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biplob018 Team Showcase and Slider – T CVE-2024-517645.5A security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS). Depending on configuration, this vulnerabi CVE-2024-517655.5A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on configuration, this vulnerability m