Read the docs
TI-2026-68639 Aliases CVE-2026-106120GHSA-fwxr-j5w2-587m

LiquidJS ownPropertyOnly bypass exposes inherited array elements

Priority HIGH 66CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

LiquidJS before 10.27.2 does not consistently apply ownPropertyOnly to inherited array indices. Negative indexing, .first, .last, the first and last filters, and for-loop iteration can read prototype-provided array elements (CWE-200). A low-privileged attacker who can influence prototype state or inherited array data can disclose values that ownPropertyOnly is meant to hide when templates render these operations.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and for-loop iteration can read prototype-provided elements outside readJSProperty(). An attacker who can influence prototype state or inherited array-index data and cause templates to render affected operations can disclose values that ownPropertyOnly is expected to hide. Direct positive indexing and ordinary object prototype reads are blocked, but the alternate array paths remain affected. This issue is fixed in 10.27.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00409 35th percentileScored 2026-11-07
Fix Fixed liquidjs (harttle): 10.27.2liquidjs (npm): 10.27.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
harttleliquidjsbefore 10.27.210.27.2Patch availableCNA
—liquidjs (npm)before 10.27.210.27.2Patch availableGHSA-fwxr-j5w2-587m
  • liquidjs Vendorharttle Affected before 10.27.2 Fixed in 10.27.2 Patch available CNA
  • liquidjs (npm) Vendor— Affected before 10.27.2 Fixed in 10.27.2 Patch available GHSA-fwxr-j5w2-587m

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:*:*:*——harttle
  • cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:*:*:* Versions — — ·harttle

Remediation

Upgrade the npm package liquidjs to 10.27.2, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA liquidjs (harttle) Fixed in 10.27.2
  • Fix · GHSA-fwxr-j5w2-587m liquidjs (npm) Fixed in 10.27.2 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-106120
  2. 2026-10-07 Alias added: GHSA-fwxr-j5w2-587m
  3. 2026-10-07 Fix available: npm/[email protected] · GHSA-fwxr-j5w2-587m
  4. 2026-10-07 CVSS score added · GHSA-fwxr-j5w2-587m
  5. 2026-10-07 Weakness changed · GHSA-fwxr-j5w2-587m
  6. 2026-10-07 6 new references · GHSA-fwxr-j5w2-587m
  7. 2026-10-07 Priority changed: MEDIUM → LOW
  8. 2026-10-09 CISA SSVC decision points changed
  9. 2026-10-09 Priority changed: LOW → HIGH

References

Advisory 1

Other 5

  • TI-2026-33363 LiquidJS is Vulnerable to Remote Code Execution CVSS 3.1CRITICAL 10.0
  • TI-2026-44110 LiquidJS: An infinite loop vulnerability in `strip_html` filter CVSS 4.0HIGH 8.7
  • TI-2026-40114 LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce CVSS 4.0HIGH 8.2
  • TI-2026-33362 LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex CVSS 3.1HIGH 7.5
  • TI-2026-29912 LiquidJS is vulnerable to Denial of Service via circular block reference in layout CVSS 3.1HIGH 7.5
  • TI-2026-28394 Information disclosure in harttle liquidjs CVSS 3.1HIGH 7.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences