Read the docs
TI-2026-33363 Aliases CVE-2026-45618GHSA-gf2q-c269-pqgc

LiquidJS is Vulnerable to Remote Code Execution

Priority HIGH 82CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00818 57th percentileScored 2026-11-07
Fix Fixed liquidjs (harttle): 10.26.0liquidjs (npm): 10.26.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
harttleliquidjsbefore 10.26.010.26.0Patch availableCNA
—liquidjs (npm)before 10.26.010.26.0Patch availableGHSA-gf2q-c269-pqgc
  • liquidjs Vendorharttle Affected before 10.26.0 Fixed in 10.26.0 Patch available CNA
  • liquidjs (npm) Vendor— Affected before 10.26.0 Fixed in 10.26.0 Patch available GHSA-gf2q-c269-pqgc

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:*:*:*——harttle
  • cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:*:*:* Versions — — ·harttle

Remediation

  • Fix · CNA liquidjs (harttle) Fixed in 10.26.0
  • Fix · GHSA-gf2q-c269-pqgc liquidjs (npm) Fixed in 10.26.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45618
  2. 2026-10-03 Alias added: GHSA-gf2q-c269-pqgc

References

Other 3

  • TI-2026-44110 LiquidJS: An infinite loop vulnerability in `strip_html` filter CVSS 4.0HIGH 8.7
  • TI-2026-40114 LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce CVSS 4.0HIGH 8.2
  • TI-2026-33362 LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex CVSS 3.1HIGH 7.5
  • TI-2026-29912 LiquidJS is vulnerable to Denial of Service via circular block reference in layout CVSS 3.1HIGH 7.5
  • TI-2026-28394 Information disclosure in harttle liquidjs CVSS 3.1HIGH 7.5
  • TI-2026-25698 LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern CVSS 3.1HIGH 7.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences