harttle

Records19All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

harttle records in CISA KEV

No harttle vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Liquidjs 9 records HIGH

Records

19 records

TI-2026-33363 CVE-2026-45618 · GHSA-gf2q-c269-pqgc

LiquidJS is Vulnerable to Remote Code Execution

HIGH 82

LiquidJS is a Shopify/GitHub Pages compatible template engine.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00818 Published 2026-08-11 Fixed in 10.26.0 CWE-94

TI-2026-44110 CVE-2026-61556 · GHSA-m7fp-h3p4-hr49

LiquidJS: An infinite loop vulnerability in `strip_html` filter

HIGH 77

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00524 Published 2026-08-19 Fixed in 10.27.1 CWE-835

TI-2026-40114 CVE-2026-55575 · GHSA-g357-x5c3-c72p

LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

HIGH 77

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00488 Published 2026-07-08 Fixed in 10.27.1 CWE-770

TI-2026-33362 CVE-2026-45617 · GHSA-r7g9-xpmj-5fcq

LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex

HIGH 72

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00458 Published 2026-06-17 Fixed in 10.26.0 CWE-1333

TI-2026-29912 CVE-2026-41311 · GHSA-4rc3-7j7w-m548

LiquidJS is vulnerable to Denial of Service via circular block reference in layout

HIGH 72

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00382 Published 2026-05-09 Fixed in 10.25.7 CWE-674

TI-2026-28394 CVE-2026-39412 · GHSA-rv5g-f82m-qrvv

Information disclosure in harttle liquidjs

HIGH 72

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0041 Published 2026-04-08 Fixed in 10.25.4 CWE-200

TI-2026-25698 CVE-2026-33287 · GHSA-6q5m-63h6-5x4v

LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern

HIGH 72

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00479 Published 2026-03-26 Fixed in 10.25.1 CWE-20

TI-2026-25696 CVE-2026-33285 · GHSA-9r5m-9576-7f6x

LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash

HIGH 72

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00414 Published 2026-03-26 Fixed in 10.25.1 CWE-20

TI-2026-27640 CVE-2026-35525 · GHSA-56p5-8mhr-2fph

LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates

HIGH 69

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00403 Published 2026-04-08 Fixed in 10.25.3 CWE-61

TI-2026-68639 CVE-2026-106120 · GHSA-fwxr-j5w2-587m

LiquidJS ownPropertyOnly bypass exposes inherited array elements

HIGH 66

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00409 Published 2026-10-06 Fixed in 10.27.2 CWE-200

TI-2026-32546 CVE-2026-44646 · GHSA-9x9p-qf8f-mvjg

LiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`

MEDIUM 63

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00334 Published 2026-06-17 Fixed in 10.26.0 CWE-693

TI-2022-09484 CVE-2022-25948 · GHSA-45rm-2893-5f49

Information exposure in liquidjs

MEDIUM 63

The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01006 Published 2022-12-23 Fixed in 10.0.0 CWE-200

TI-2026-32545 CVE-2026-44645 · GHSA-8xx9-69p8-7jp3

LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

MEDIUM 62

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00385 Published 2026-06-17 Fixed in 10.26.0 CWE-400

TI-2026-32544 CVE-2026-44644 · GHSA-2qv6-9wx5-cwv4

LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS

MEDIUM 60

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0025 Published 2026-06-17 Fixed in 10.26.0 CWE-79

TI-2026-26466 CVE-2026-34166 · GHSA-mmg9-6m6j-jqqx

LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter

MEDIUM 57

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00514 Published 2026-04-08 Fixed in 10.25.3 CWE-400

TI-2026-23777 CVE-2026-30952 · GHSA-wmfp-5q7x-987x

liquidjs has a path traversal fallback vulnerability

MEDIUM 45

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00615 Published 2026-03-10 Fixed in 10.25.0 CWE-22

TI-2026-48565 CVE-2026-69222 · GHSA-4r6h-5v86-94p3

Uncontrolled resource consumption in harttle liquidjs

MEDIUM 40

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-08-19 Fixed in 10.27.2 CWE-400

TI-2026-33148 CVE-2026-45357 · GHSA-hh27-hf48-9f5q

LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime)

LOW 39

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00385 Published 2026-06-17 Fixed in 10.26.0 CWE-400

TI-2026-28740 CVE-2026-39859 · GHSA-v273-448j-v4qj

LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read

LOW 34

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00465 Published 2026-04-08 Fixed in 10.25.3, 10.25.5 CWE-22

Open these records in search →

Critical	1
High	11
Medium	7
Low	0
No CVSS	0