CVE-2026-33287

CVE-2026-33287 is not active by itself; connected advisory GHSA-6Q5M-63H6-5X4V documents a concrete vulnerability in LiquidJS. The issue lies in the replace_first filter: it delegates to String.prototype.replace() and charges memoryLimit only for the input, allowing exponential growth of the outp...