Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface

Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name

Twig: PHP code injection via `{% use %}` template name

Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation

Twig: Sandbox method allowlist bypass via `Markup` subclass

Twig has a possible sandbox bypass

Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments

Twig: Sandbox resource exhaustion via unbounded `for` / `range()`

Twig: Sandbox property and method bypass via object-destructuring assignment

Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points

Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

Twig: XSS in profiler HtmlDumper via unescaped template and profile names

Twig: The `spaceless` filter implicitly marks its output as safe

Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)