TI-2026-68639 CVE-2026-106120 · GHSA-fwxr-j5w2-587m
LiquidJS ownPropertyOnly bypass exposes inherited array elements
Priority HIGH 66
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
Vulnerabilities
19 records
TI-2026-48565 CVE-2026-69222 · GHSA-4r6h-5v86-94p3
Uncontrolled resource consumption in harttle liquidjs
Priority MEDIUM 40
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-44110 CVE-2026-61556 · GHSA-m7fp-h3p4-hr49
LiquidJS: An infinite loop vulnerability in `strip_html` filter
Priority HIGH 77
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-33363 CVE-2026-45618 · GHSA-gf2q-c269-pqgc
LiquidJS is Vulnerable to Remote Code Execution
Priority HIGH 82
LiquidJS is a Shopify/GitHub Pages compatible template engine.
TI-2026-40114 CVE-2026-55575 · GHSA-g357-x5c3-c72p
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
Priority HIGH 77
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-33148 CVE-2026-45357 · GHSA-hh27-hf48-9f5q
LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime)
Priority LOW 39
LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript.
TI-2026-32546 CVE-2026-44646 · GHSA-9x9p-qf8f-mvjg
LiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
Priority MEDIUM 63
LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript.
TI-2026-33362 CVE-2026-45617 · GHSA-r7g9-xpmj-5fcq
LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex
Priority HIGH 72
LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript.
TI-2026-32545 CVE-2026-44645 · GHSA-8xx9-69p8-7jp3
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
Priority MEDIUM 62
LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript.
TI-2026-32544 CVE-2026-44644 · GHSA-2qv6-9wx5-cwv4
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
Priority MEDIUM 60
LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript.
TI-2026-29912 CVE-2026-41311 · GHSA-4rc3-7j7w-m548
LiquidJS is vulnerable to Denial of Service via circular block reference in layout
Priority HIGH 72
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-28740 CVE-2026-39859 · GHSA-v273-448j-v4qj
LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read
Priority LOW 34
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-28394 CVE-2026-39412 · GHSA-rv5g-f82m-qrvv
Information disclosure in harttle liquidjs
Priority HIGH 72
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-27640 CVE-2026-35525 · GHSA-56p5-8mhr-2fph
LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates
Priority HIGH 69
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-26466 CVE-2026-34166 · GHSA-mmg9-6m6j-jqqx
LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter
Priority MEDIUM 57
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-25696 CVE-2026-33285 · GHSA-9r5m-9576-7f6x
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
Priority HIGH 72
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-25698 CVE-2026-33287 · GHSA-6q5m-63h6-5x4v
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
Priority HIGH 72
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2026-23777 CVE-2026-30952 · GHSA-wmfp-5q7x-987x
liquidjs has a path traversal fallback vulnerability
Priority MEDIUM 45
liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript.
TI-2022-09484 CVE-2022-25948 · GHSA-45rm-2893-5f49
Information exposure in liquidjs
Priority MEDIUM 63
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype.