235 matches found
Denial of Service (DoS)
Overview liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. Affected versions of this package are vulnerable to Denial of Service DoS through the renderTemplates function when the for or tablerow tag is used with an empty body. An attacker can...
GHSA-8XX9-69P8-7JP3 LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
Summary The renderLimit option — documented in docs/source/tutorials/dos.md as the mechanism that "mitigates this by limiting the time consumed by each render call" — can be fully bypassed by a % for % or % tablerow % tag whose body is empty. The per-iteration time check is reached only when the...
@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +167 more potentially affected by CVE-2026-44644 via liquidjs (>=10.2.0, <=10.25.7)
liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.8.0, =0.31.16 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-44644 Source advisory: SNYK:JS-LIQUIDJS-1688788...
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
Summary The striphtml filter in liquidjs is intended to remove HTML tags from a string before rendering, and is widely used as an XSS sanitizer. The implementation uses a regex whose catch-all branch does not match line terminators, so any HTML tag containing a \n or \r character passes through...
@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +167 more potentially affected by CVE-2026-44644 via liquidjs (>=10.2.0, <=10.25.7)
liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.8.0, =0.31.16 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-44644 Source advisory: OSV:GHSA-2QV6-9WX5-CWV4...
GHSA-2QV6-9WX5-CWV4 LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
Summary The striphtml filter in liquidjs is intended to remove HTML tags from a string before rendering, and is widely used as an XSS sanitizer. The implementation uses a regex whose catch-all branch does not match line terminators, so any HTML tag containing a \n or \r character passes through...
PT-2026-44156
Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.26.0 Description The built-in strip html filter uses a regular expression containing four flawed lazy-quantified alternatives. When processing input with numerous script, style, or !-- opener tokens that lack...
PT-2026-44157
Name of the Vulnerable Software and Affected Versions liquidjs versions prior to 10.26.0 Description LiquidJS is a template engine compatible with Shopify and GitHub Pages. A critical issue allows unauthenticated remote attackers to achieve arbitrary code execution through crafted templates. The...
CVE-2026-45617
creationtimestamp| type| source ---|---|--- 2026-05-24 13:22:51+00:00| published-proof-of-concept| https://github.com/harttle/liquidjs/security/advisories/GHSA-r7g9-xpmj-5fcq...
CVE-2026-45618
creationtimestamp| type| source ---|---|--- 2026-05-24 13:22:43+00:00| published-proof-of-concept| https://github.com/harttle/liquidjs/security/advisories/GHSA-gf2q-c269-pqgc 2026-08-11 20:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mstiir6g362q...
CVE-2026-45357
creationtimestamp| type| source ---|---|--- 2026-05-24 13:22:38+00:00| published-proof-of-concept| https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q...
CVE-2026-41311
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in % layout % / % block % causes an infinite recursive loop, consuming all available memory 4GB and crashing the Node.js process with FATAL ERROR: JavaScript he...
CVE-2026-41311
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in % layout % / % block % causes an infinite recursive loop, consuming all available memory 4GB and crashing the Node.js process with FATAL ERROR: JavaScript he...
CVE-2026-41311 LiquidJS is vulnerable to Denial of Service via circular block reference in layout
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in % layout % / % block % causes an infinite recursive loop, consuming all available memory 4GB and crashing the Node.js process with FATAL ERROR: JavaScript he...
CVE-2026-41311
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in % layout % / % block % causes an infinite recursive loop, consuming all available memory 4GB and crashing the Node.js process with FATAL ERROR: JavaScript he...
CVE-2026-41311 LiquidJS is vulnerable to Denial of Service via circular block reference in layout
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in % layout % / % block % causes an infinite recursive loop, consuming all available memory 4GB and crashing the Node.js process with FATAL ERROR: JavaScript he...
CVE-2026-41311
Vulnerability: CVE-2026-41311 affects LiquidJS (Shopify/GitHub Pages compatible template engine). Before 10.25.7, a circular reference in {% layout %} / {% block %} can trigger infinite recursion, exhausting memory (~4 GB) and crashing the Node.js process. Impact: Denial of Service from user-subm...
EUVD-2026-28886
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in % layout % / % block % causes an infinite recursive loop, consuming all available memory 4GB and crashing the Node.js process with FATAL ERROR: JavaScript he...
liquidjs 安全漏洞
liquidjs is a simple, expressive, secure and Shopify-compatible pure JavaScript template engine by Jun Yang, a personal developer. A security vulnerability exists in liquidjs versions prior to 10.25.7, which stems from a circular block reference that leads to an infinite recursive loop, consuming...
CVE-2026-41311: Uncontrolled Recursion
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in % layout % / % block % causes an infinite recursive loop, consuming all available memory 4GB and crashing the Node.js process with FATAL ERROR: JavaScript he...