CVE-2026-69222

LiquidJS versions prior to 10.27.2 have a memory-limit accounting defect in the join and array_to_sentence_string filters: they bill complexity by element count rather than output string length, so a crafted template can allocate toward V8's memory limits and crash the process. Exploitation requi...

shopify-scripts: Read after free in mrb_vm_exec with OP_ARYCAT reading R(B)

Hi, Slightly different one, this is a use after free as reported by an ASAN compiled binary. This one doesn't affect mruby-engine with the current instruction limit and memory limit, but if they are increased then it does. The file is: class Klazz def $thing.name [email protected]@thing.name nil end...