PT-2026-24182

Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.25.0 Description The layout, render, and include tags are susceptible to arbitrary file access through absolute paths. This can occur when paths are provided as string literals or through Liquid variables,...

liquidjs 路径遍历漏洞

LiquidJS is a simple, expressive, secure, and compatible JavaScript template engine developed by Jun Yang. Versions of LiquidJS prior to 10.25.0 had a path traversal vulnerability. This vulnerability stems from the layout, render, and include tags allowing access to arbitrary files via absolute...

CVE-2026-30952: Improper Limitation of a Pathname to a Restricted Directory

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the...

EUVD-2022-7496

Malicious code in bioql PyPI...

CVE-2022-25948 Information Exposure

The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided...

CVE-2022-25948

CVE-2022-25948 affects liquidjs prior to 10.0.0, where Information Exposure occurs when ownPropertyOnly is set to False, leaking prototype properties. Public details in connected docs specify the affected software (liquidjs) and the root cause (prototype property leakage via ownPropertyOnly). The...

CVE-2022-25948 Information Exposure

The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided...

Information Disclosure

liquidjs is vulnerable to information disclosure. The vulnerability exists in the readProperty function in context.ts, which will result in leaking properties of a prototype when the ownpropertyonly parameter is set to false...

CVE-2022-25948: Exposure of Sensitive Information to an Unauthorized Actor

The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided...

liquidjs may leak properties of a prototype

The package liquidjs before 10.0.0 is vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided...

GHSA-45RM-2893-5F49 liquidjs may leak properties of a prototype

The package liquidjs before 10.0.0 is vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided...

CVE-2022-25948 Information Exposure

The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided...

liquidjs 信息泄露漏洞

liquidjs is a simple, expressive, secure and Shopify-compatible pure JavaScript template engine by Jun Yang. A security vulnerability exists in liquidjs versions prior to 10.0.0, which stems from the vulnerability to information exposure when the ownPropertyOnly parameter is set to False, leading...

PT-2022-17615 · Liquidjs · Liquidjs

Name of the Vulnerable Software and Affected Versions: liquidjs versions prior to 10.0.0 Description: The issue concerns Information Exposure when the ownPropertyOnly parameter is set to False, resulting in the leaking of properties of a prototype. Recommendations: For versions 9.34.0 and higher,...

Information Exposure

Overview liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. Affected versions of this package are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For...