TI-2026-29912 CVE-2026-41311 · GHSA-4rc3-7j7w-m548
LiquidJS is vulnerable to Denial of Service via circular block reference in layout
Priority HIGH 72
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
Vulnerabilities
9 records
TI-2026-28740 CVE-2026-39859 · GHSA-v273-448j-v4qj
LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read
Priority LOW 34
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-28394 CVE-2026-39412 · GHSA-rv5g-f82m-qrvv
Information disclosure in harttle liquidjs
Priority HIGH 72
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-27640 CVE-2026-35525 · GHSA-56p5-8mhr-2fph
LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates
Priority HIGH 69
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-26466 CVE-2026-34166 · GHSA-mmg9-6m6j-jqqx
LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter
Priority MEDIUM 57
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-25696 CVE-2026-33285 · GHSA-9r5m-9576-7f6x
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
Priority HIGH 72
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-25698 CVE-2026-33287 · GHSA-6q5m-63h6-5x4v
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
Priority HIGH 72
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-23777 CVE-2026-30952 · GHSA-wmfp-5q7x-987x
liquidjs has a path traversal fallback vulnerability
Priority MEDIUM 45
liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2022-09484 CVE-2022-25948 · GHSA-45rm-2893-5f49
Information exposure in liquidjs
Priority MEDIUM 63
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype.