3extensions (1.0.1), @0xtender/events-schema-generator (>=0.0.4, <=0.2.11) +454 more potentially affected by CVE-2026-30952 via liquidjs (>=1.9.7, <=10.24.0)

liquidjs NPM version =1.9.7, =0.0.4, =0.2.0, =1.0.0, =1.0.0, =1.0.0, =0.6.0, =0.1.0, =0.0.0, =0.1.0, =1.0.0-beta.1, =0.0.4, =1.0.0 and more Source cves: CVE-2026-30952 Source advisory: MEND:CVE-2026-30952...

CVE-2026-30952 liquidjs has a path traversal fallback vulnerability

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the...

GHSA-WMFP-5Q7X-987X liquidjs has a path traversal fallback vulnerability

Impact The layout, render, and include tags allow arbitrary file access via absolute paths either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default. This poses a security risk when malicious users are allowed to control the template...

liquidjs has a path traversal fallback vulnerability

Impact The layout, render, and include tags allow arbitrary file access via absolute paths either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default. This poses a security risk when malicious users are allowed to control the template...

EUVD-2026-10872

liquidjs has a path traversal fallback vulnerability...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +127 more potentially affected by CVE-2026-30952 via liquidjs (>=10.2.0, <=10.24.0)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =12.0.0, =1.0.1-beta.0, =1.6.3, =3.11.0-rc.0, =3.11.0-rc.0, =3.11.0-rc.0, =0.9.33, =1.0.0, =1.0.10 and more Source cves: CVE-2026-30952 Source advisory: SNYK:JS-LIQUIDJS-15443434...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +127 more potentially affected by CVE-2026-30952 via liquidjs (>=10.2.0, <=10.24.0)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =12.0.0, =1.0.1-beta.0, =1.6.3, =3.11.0-rc.0, =3.11.0-rc.0, =3.11.0-rc.0, =0.9.33, =1.0.0, =1.0.10 and more Source cves: CVE-2026-30952 Source advisory: OSV:GHSA-WMFP-5Q7X-987X...

Directory Traversal

Overview liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. Affected versions of this package are vulnerable to Directory Traversal via the Loader.candidates resolution when require.resolve is used as a fallback; an attacker can read arbitrary...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +127 more potentially affected by CVE-2026-30952 via liquidjs (>=10.2.0, <=10.24.0)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =12.0.0, =1.0.1-beta.0, =1.6.3, =3.11.0-rc.0, =3.11.0-rc.0, =3.11.0-rc.0, =0.9.33, =1.0.0, =1.0.10 and more Source cves: CVE-2026-30952 Source advisory: GHSA-WMFP-5Q7X-987X...

CVE-2026-30952: Improper Limitation of a Pathname to a Restricted Directory

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the...

PT-2026-24182

Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.25.0 Description The layout, render, and include tags are susceptible to arbitrary file access through absolute paths. This can occur when paths are provided as string literals or through Liquid variables,...

LiquidJS path traversal vulnerability

LiquidJS is a simple, expressive, secure, and compatible JavaScript template engine developed by Jun Yang. Versions of LiquidJS prior to 10.25.0 had a path traversal vulnerability. This vulnerability stems from the layout, render, and include tags allowing access to arbitrary files via absolute...

EUVD-2022-7496

Malicious code in bioql PyPI...

CVE-2022-25948

The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided...

3extensions (1.0.1), @11ty/eleventy (>=0.2.0, <=2.0.0-canary.18) +351 more potentially affected by CVE-2022-25948 via liquidjs (>=1.9.7, <=9.43.0)

liquidjs NPM version =1.9.7, =0.2.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0-beta.1, =0.0.4, =0.0.2, =0.0.1, =1.2.0, =0.0.1, =0.0.9, =0.3.6 and more Source cves: CVE-2022-25948 Source advisory: MEND:CVE-2022-25948...

CVE-2022-25948

CVE-2022-25948 affects liquidjs prior to 10.0.0, where Information Exposure occurs when ownPropertyOnly is set to False, leaking prototype properties. Public details in connected docs specify the affected software (liquidjs) and the root cause (prototype property leakage via ownPropertyOnly). The...

CVE-2022-25948 Information Exposure

The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided...

CVE-2022-25948 Information Exposure

The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided...

Information Disclosure

liquidjs is vulnerable to information disclosure. The vulnerability exists in the readProperty function in context.ts, which will result in leaking properties of a prototype when the ownpropertyonly parameter is set to false...

CVE-2022-25948: Exposure of Sensitive Information to an Unauthorized Actor

The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided...