Sandbox policy bypass via nested object stringification

Sandbox bypass in Twig before 3.11.2 and 3.12.0 through 3.14.0 allows remote authenticated users to disclose data through object stringification. SandboxNodeVisitor fails to wrap objects nested in ArrayExpression nodes or argument lists with CheckToStringNode, so string conversion skips the policy's checkMethodAllowed call. Exploitation requires a sandboxed application that lets a highly privileged user supply a template and passes a Stringable object through an array, function, or filter; the documented consequence is limited confidentiality loss.