This vulnerability is a residual bypass of a previous fix for unguarded __toString() calls in twig/twig. The SandboxExtension::ensureToStringAllowed() method originally recursed into PHP arrays to check Stringable objects against the sandbox policy but did not materialize or check contents of Traversable inputs passed to join and replace filters. These filters later coerce contained Stringable objects to strings without policy checks. Similarly, the in and not in operators use PHP's spaceship operator which coerces Stringable objects to strings without sandbox checks, allowing bypass and potential content leak. The fix added recursive checking of Traversable operands and declared operands of in/not in as string-coerced to enforce policy checks before string coercion.

Sandboxed template authors with permission to use join, replace, in, or not in can trigger disallowed __toString() method calls on objects in the render context, bypassing sandbox policy restrictions. This can lead to unauthorized execution of __toString() methods that were intended to be blocked, potentially exposing sensitive data or causing unintended side effects. The vulnerability affects sandboxed environments and can also be used as a content-leak oracle via the in operator.

A fix is available in twig/twig version 3.27.0 that addresses this bypass by recursively checking Traversable inputs and properly enforcing sandbox policy on string coercion in the affected filters and operators. Users should upgrade to version 3.27.0 or later to remediate this vulnerability. No other mitigation is required as the fix fully addresses the issue.