packagist.org: twig/twig

Twig, the flexible, fast, and secure template language for PHP

• Homepage: https://twig.symfony.com
• Licenses: BSD-3-Clause
• Latest release: v3.30.0 (published about 1 month ago)
• Last Synced: 2026-11-01T12:18:55.830Z (1 day ago)
• Versions: 252
• Dependent Packages: 5,794
• Dependent Repositories: 131,829
• Downloads: 506,140,798 Total
• Docker Downloads: 806,416,720
• Rankings:
  • Dependent packages count: 0.005%
  • Downloads: 0.022%
  • Dependent repos count: 0.029%
  • Average: 0.03%
  • Docker downloads count: 0.037%
  • Stargazers count: 0.04%
  • Forks count: 0.045%
• Maintainers (1)
  • fabpot
• Funding:
  • url: https://github.com/fabpot: type: github
  • url: https://tidelift.com/funding/github/packagist/twig/twig: type: tidelift
• Advisories:
  • Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
  • Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
  • Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
  • Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
  • Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
  • Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
  • Twig: XSS in profiler HtmlDumper via unescaped template and profile names
  • Twig: Possible sandbox bypass when using a source policy
  • Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
  • Twig: Sandbox property and method bypass via object-destructuring assignment
  • Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
  • Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
  • Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
  • Twig: PHP code injection via `{% use %}` template name
  • Twig: The `spaceless` filter implicitly marks its output as safe
  • Twig security issue where escaping was missing when using null coalesce operator
  • Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled
  • Twig has unguarded calls to `__toString()` when nesting an object into an array
  • Twig has a possible sandbox bypass
  • Twig Path Traversal vulnerability in the filesystem loader
  • Twig may load a template outside a configured directory when using the filesystem loader
  • Twig remote code execution in templates
  • Twig Sandbox Information Disclosure
  • Code injection in Twig

proxy.golang.org: github.com/twigphp/Twig

• Homepage:
• Documentation: https://pkg.go.dev/github.com/twigphp/Twig#section-documentation
• Licenses: bsd-3-clause
• Latest release: v3.30.0+incompatible (published about 1 month ago)
• Last Synced: 2026-10-31T16:31:27.946Z (2 days ago)
• Versions: 275
• Dependent Packages: 0
• Dependent Repositories: 1
• Rankings:
  • Forks count: 0.738%
  • Stargazers count: 0.743%
  • Average: 3.682%
  • Dependent repos count: 4.794%
  • Dependent packages count: 8.453%

proxy.golang.org: github.com/Twigphp/Twig

• Homepage:
• Documentation: https://pkg.go.dev/github.com/Twigphp/Twig#section-documentation
• Licenses: bsd-3-clause
• Latest release: v3.30.0+incompatible (published about 1 month ago)
• Last Synced: 2026-10-31T16:31:36.027Z (2 days ago)
• Versions: 275
• Dependent Packages: 0
• Dependent Repositories: 0
• Rankings:
  • Dependent packages count: 4.262%
  • Average: 4.408%
  • Dependent repos count: 4.553%

proxy.golang.org: github.com/twigphp/twig

• Homepage:
• Documentation: https://pkg.go.dev/github.com/twigphp/twig#section-documentation
• Licenses: bsd-3-clause
• Latest release: v6.0.6+incompatible (published over 4 years ago)
• Last Synced: 2026-10-31T16:31:25.846Z (2 days ago)
• Versions: 276
• Dependent Packages: 0
• Dependent Repositories: 0
• Rankings:
  • Stargazers count: 0.732%
  • Forks count: 0.734%
  • Average: 4.686%
  • Dependent packages count: 7.917%
  • Dependent repos count: 9.361%

proxy.golang.org: github.com/TwigPhp/twig

• Homepage:
• Documentation: https://pkg.go.dev/github.com/TwigPhp/twig#section-documentation
• Licenses: bsd-3-clause
• Latest release: v3.30.0+incompatible (published about 1 month ago)
• Last Synced: 2026-10-31T16:31:18.530Z (2 days ago)
• Versions: 275
• Dependent Packages: 0
• Dependent Repositories: 0
• Rankings:
  • Dependent packages count: 4.568%
  • Average: 4.721%
  • Dependent repos count: 4.875%