CVE-2026-46633: Anthropic Python single-quote

Q: Is CVE-2026-46633 actively exploited?

No confirmed active exploitation of CVE-2026-46633 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-46633?

1) Upgrade twig/twig to 3.26.0 or later (composer update twig/twig) and rebuild applications that bundle it, such as Symfony, Drupal and Craft. 2) After patching, clear and regenerate the Twig compiled-template cache, because a malicious cache file written earlier will still execute. 3) Do not let untrusted users or LLM output control template names or template source. 4) Do not treat the Twig sandbox as a security boundary for this issue, since SecurityPolicy always allows {% use %}. 5) Detect: search template sources and cache directories for {% use %} tags with unusual names that contain single quotes or PHP-like syntax, and review web logs for anomalous template parameters. 6) Run composer audit and check SBOMs for transitive Twig usage.

Q: What systems are affected by CVE-2026-46633?

This vulnerability affects the following AI/ML architecture patterns: PHP web applications fronting AI services, LLM gateway admin portals, Template-driven prompt management tools, CMS-based AI content platforms.

Q: What is the CVSS score for CVE-2026-46633?

CVE-2026-46633 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.69%.

CISO Take

Twig, the PHP template engine, fails to escape single quotes when compiling the template name in a {% use %} tag. An attacker who controls a template name can inject arbitrary PHP into the compiled cache file and run code on the server, even inside the Twig sandbox, because the sandbox policy always allows {% use %}. The CVSS score is 9.8, and 6,349 packages depend on Twig. Against that, EPSS is only 0.00688 (top 47%), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. Twig is a general-purpose library, not an AI component, so exposure to AI workloads is indirect: it applies only where AI web front ends, dashboards or LLM-generated templates are built on PHP and Twig. Upgrade twig/twig to 3.26.0 or later. Until then, make sure untrusted users cannot influence template names or template source.

Sources:NVDEPSSGitHub Advisorysymfony.comATLAS

What is the risk?

The technical severity is critical: CWE-94 code injection with a network vector, no privileges and full CIA impact. Real-world exploitability depends on an attacker being able to supply template names or template source, for example through user-editable templates, a CMS, or LLM-generated or user-submitted Twig. The low EPSS, no known exploit, no KEV listing and the 'No' for public exploit availability point to low near-term mass exploitation. The advisory credits discovery to Anvil Secure working with Claude and Anthropic Research, and the issue has a published proof-of-concept gist, so weaponization is easy for attackers who can reach the vulnerable path. For AI/ML organizations the risk is moderate and indirect, since Twig is not an AI package.

How does the attack unfold?

Initial Access

Attacker supplies a crafted template name containing a single quote through a user-controlled template or an editable template feature.

AML.T0049

Code Injection

Compiler::string() leaves the single quote unescaped, so the name breaks out of the PHP single-quoted literal in the compiled cache file.

AML.T0050

Execution

The injected PHP runs when the cache file is first loaded, bypassing the Twig sandbox.

Impact

Attacker steals LLM API keys and database credentials, then plants persistence or pivots to AI infrastructure.

AML.T0112

Initial Access

Attacker supplies a crafted template name containing a single quote through a user-controlled template or an editable template feature.

AML.T0049

Code Injection

Compiler::string() leaves the single quote unescaped, so the name breaks out of the PHP single-quoted literal in the compiled cache file.

AML.T0050

Execution

The injected PHP runs when the cache file is first loaded, bypassing the Twig sandbox.

Impact

Attacker steals LLM API keys and database credentials, then plants persistence or pivots to AI infrastructure.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	composer	>= 1.15.1, < 3.26.0	`3.26.0`
4.0K6.3K dependentsPushed 11d ago93% patched~11d to patchFull package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade twig/twig to 3.26.0 or later (composer update twig/twig) and rebuild applications that bundle it, such as Symfony, Drupal and Craft. 2) After patching, clear and regenerate the Twig compiled-template cache, because a malicious cache file written earlier will still execute. 3) Do not let untrusted users or LLM output control template names or template source. 4) Do not treat the Twig sandbox as a security boundary for this issue, since SecurityPolicy always allows {% use %}. 5) Detect: search template sources and cache directories for {% use %} tags with unusual names that contain single quotes or PHP-like syntax, and review web logs for anomalous template parameters. 6) Run composer audit and check SBOMs for transitive Twig usage.

How is it classified?

Code ExecutionSupply ChainFrameworkAPIAML.T0010.001- AI Software AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

GOVERN 6.1-Policies and procedures address AI risks associated with third-party entities

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-46633?

Twig, the PHP template engine, fails to escape single quotes when compiling the template name in a {% use %} tag. An attacker who controls a template name can inject arbitrary PHP into the compiled cache file and run code on the server, even inside the Twig sandbox, because the sandbox policy always allows {% use %}. The CVSS score is 9.8, and 6,349 packages depend on Twig. Against that, EPSS is only 0.00688 (top 47%), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. Twig is a general-purpose library, not an AI component, so exposure to AI workloads is indirect: it applies only where AI web front ends, dashboards or LLM-generated templates are built on PHP and Twig. Upgrade twig/twig to 3.26.0 or later. Until then, make sure untrusted users cannot influence template names or template source.

Is CVE-2026-46633 actively exploited?

No confirmed active exploitation of CVE-2026-46633 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-46633?

1) Upgrade twig/twig to 3.26.0 or later (composer update twig/twig) and rebuild applications that bundle it, such as Symfony, Drupal and Craft. 2) After patching, clear and regenerate the Twig compiled-template cache, because a malicious cache file written earlier will still execute. 3) Do not let untrusted users or LLM output control template names or template source. 4) Do not treat the Twig sandbox as a security boundary for this issue, since SecurityPolicy always allows {% use %}. 5) Detect: search template sources and cache directories for {% use %} tags with unusual names that contain single quotes or PHP-like syntax, and review web logs for anomalous template parameters. 6) Run composer audit and check SBOMs for transitive Twig usage.

What systems are affected by CVE-2026-46633?

This vulnerability affects the following AI/ML architecture patterns: PHP web applications fronting AI services, LLM gateway admin portals, Template-driven prompt management tools, CMS-based AI content platforms.

What is the CVSS score for CVE-2026-46633?

CVE-2026-46633 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.69%.

What is the AI security impact?

Affected AI Architectures

PHP web applications fronting AI servicesLLM gateway admin portalsTemplate-driven prompt management toolsCMS-based AI content platforms

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

### Description `Compiler::string()` escapes `"`, `$`, `\`, NUL and TAB when generating PHP double-quoted string literals, but does not escape single quotes. In `ModuleNode::compileConstructor()`, the template name from a `{% use %}` tag is compiled via `subcompile()` -> `string()` and placed inside a surrounding PHP single-quoted string literal. A template name containing a single quote terminates that surrounding string early, allowing arbitrary PHP expressions to be injected into the compiled cache file. The injected code executes within the PHP process when the cache file is first loaded, bypassing the Twig sandbox entirely and achieving remote code execution. `SecurityPolicy` unconditionally allows `{% use %}` regardless of the configured `allowedTags`, so this primitive is reachable from sandboxed templates as well. ### Resolution `Compiler::string()` now also escapes single quotes so that template names placed inside single-quoted PHP literals can no longer break out of the surrounding context. ### Credits Twig would like to thank Anvil Secure in collaboration with Claude and Anthropic Research for reporting the issue and providing the fix.

Exploitation Scenario

An organization runs a PHP-based admin portal for an internal LLM gateway. It lets staff or tenants edit prompt and report templates in Twig, with the sandbox enabled as the safeguard. The attacker submits a template containing a {% use %} tag whose template name includes a single quote followed by injected PHP. When the template compiles, the injected code lands in the cache file and executes the first time the cache is loaded. The attacker then reads environment variables holding LLM provider API keys and vector database credentials, and can plant a web shell or pivot to model-serving infrastructure.

Weaknesses (CWE)

CWE-94Improper Control of Generation of CodePrimary

CWE-94 — Improper Control of Generation of Code: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.