33 matches found
LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration
Summary LiquidJS’s ownPropertyOnly option is intended to prevent templates from reading inherited or prototype properties from scope data. With ownPropertyOnly: true, direct access such as: liquid a0 correctly blocks an inherited array index. However, the same inherited value is still disclosed...
6CVSS5.8AI score0.0035EPSS
SaveExploits0References6Affected Software1
20