This vulnerability is a residual bypass of a previous fix for unguarded __toString() calls in twig/twig. In version 3.26.0, the sandbox visitor was extended to wrap child nodes coerced to strings with a check node, but ArrayExpression did not implement the required interface for its dynamic mapping keys. When a dynamic key resolves to a Stringable object, PHP invokes __toString() directly without sandbox policy checks, allowing sandboxed template authors to trigger __toString() on any object reachable in the render context. The fix in version 3.27.0 adds the interface to ArrayExpression's dynamic keys, ensuring sandbox policy checks occur before string coercion, closing the enforcement gap.

The vulnerability allows unauthorized disclosure of data returned by __toString() methods on objects accessible in the sandboxed template context. This is a policy enforcement gap that can lead to information leakage within sandboxed Twig templates. Direct output of objects is correctly blocked, so the impact is limited to dynamic mapping keys used as string keys in arrays.

A fix is available in twig/twig version 3.27.0 that properly enforces sandbox __toString() policy on dynamic mapping keys. Users should upgrade to version 3.27.0 or later to remediate this vulnerability. No other mitigation is indicated.