Read the docs
TI-2026-44110 Aliases CVE-2026-61556GHSA-m7fp-h3p4-hr49

LiquidJS: An infinite loop vulnerability in `strip_html` filter

Priority HIGH 77CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-835.

Summary

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In strip_html, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a<. This issue is fixed in version 10.27.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Fix Fixed liquidjs (harttle): 10.27.1liquidjs (npm): 10.27.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
harttleliquidjs10.26.0 to before 10.27.110.27.1Patch availableCNA
—liquidjs (npm)10.26.0 to before 10.27.110.27.1Patch availableGHSA-m7fp-h3p4-hr49
  • liquidjs Vendorharttle Affected 10.26.0 to before 10.27.1 Fixed in 10.27.1 Patch available CNA
  • liquidjs (npm) Vendor— Affected 10.26.0 to before 10.27.1 Fixed in 10.27.1 Patch available GHSA-m7fp-h3p4-hr49

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:*:*:*——harttle
  • cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:*:*:* Versions — — ·harttle

Remediation

  • Fix · CNA liquidjs (harttle) Fixed in 10.27.1
  • Fix · GHSA-m7fp-h3p4-hr49 liquidjs (npm) Fixed in 10.27.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61556
  2. 2026-10-03 Alias added: GHSA-m7fp-h3p4-hr49

References

Advisory 1

Other 5

  • TI-2026-33363 LiquidJS is Vulnerable to Remote Code Execution CVSS 3.1CRITICAL 10.0
  • TI-2026-40114 LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce CVSS 4.0HIGH 8.2
  • TI-2026-33362 LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex CVSS 3.1HIGH 7.5
  • TI-2026-29912 LiquidJS is vulnerable to Denial of Service via circular block reference in layout CVSS 3.1HIGH 7.5
  • TI-2026-28394 Information disclosure in harttle liquidjs CVSS 3.1HIGH 7.5
  • TI-2026-25698 LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern CVSS 3.1HIGH 7.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences