[HIGH] Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

PKSA-8zx5-v2nz-58pb CVE-2026-49981 GHSA-529h-vh3j-85hq

Affected package: twig/twig

Affected version: <=3.26.0

Reported by:
GitHub