Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
•added 2026/05/27 12:28 a.m.•36 views

LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`

Summary Context.spawn in liquidjs creates a child Context for the % render % tag but does not propagate the parent context's resolved ownPropertyOnly value. The new context re-derives ownPropertyOnly from opts.ownPropertyOnly the instance-level option, silently discarding any...

5.3CVSS5.8AI score0.0044EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder