pharia-inference-sdk (0.1.0), solace-agent-mesh (>=1.8.0, <=1.28.4) potentially affected by CVE-2026-55865 via python-liquid (>=2.0.2, <=2.2.0)

python-liquid PYPI version =2.0.2, =1.8.0, =1.28.4 Source cves: CVE-2026-55865 Source advisory: GHSA-VQ2F-VCC9-J8MV...

pharia-inference-sdk (0.1.0), solace-agent-mesh (>=1.8.0, <=1.28.4) potentially affected by CVE-2026-55865 via python-liquid (>=2.0.2, <=2.2.0)

python-liquid PYPI version =2.0.2, =1.8.0, =1.28.4 Source cves: CVE-2026-55865 Source advisory: OSV:GHSA-VQ2F-VCC9-J8MV...

python-fhir-converter (0.0.22) potentially affected by CVE-2026-55865 via python-liquid (1.11.0)

python-liquid PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - python-fhir-converter 0.0.22 Source cves: CVE-2026-55865 Source advisory: OSV:GHSA-VQ2F-VCC9-J8MV...

blrec (>=1.8.0a3, <=2.0.0b5), dagster-looker (>=0.26.6rc0, <=0.29.21) +2 more potentially affected by CVE-2026-55865 via python-liquid (1.13.0)

python-liquid PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - blrec =1.8.0a3, =0.26.6rc0, =0.8.0, =0.0.1, =0.0.20 Source cves: CVE-2026-55865 Source advisory: OSV:GHSA-VQ2F-VCC9-J8MV...

plainqafact (>=0.4.0, <=1.1.0), python-fhir-converter (0.0.21) potentially affected by CVE-2026-55865 via python-liquid (1.10.2)

python-liquid PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - plainqafact =0.4.0, =1.1.0 - python-fhir-converter 0.0.21 Source cves: CVE-2026-55865 Source advisory: OSV:GHSA-VQ2F-VCC9-J8MV...

GHSA-VQ2F-VCC9-J8MV Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

Impact Given a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. Patches The issue is fixed in...

pharia-data-sdk (>=0.1.1, <=0.1.6), pharia-inference-sdk (>=0.1.2, <=0.1.6) +1 more potentially affected by CVE-2026-55865 via python-liquid (1.9.4)

python-liquid PYPI version 1.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - pharia-data-sdk =0.1.1, =0.1.2, =0.1.0, =0.1.7 Source cves: CVE-2026-55865 Source advisory: OSV:GHSA-VQ2F-VCC9-J8MV...

python-fhir-converter (>=0.1.0, <=0.3.0) potentially affected by CVE-2026-55865 via python-liquid (1.12.1)

python-liquid PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - python-fhir-converter =0.1.0, =0.3.0 Source cves: CVE-2026-55865 Source advisory: OSV:GHSA-VQ2F-VCC9-J8MV...

CVE-2026-45017

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and...

CVE-2026-45017

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and...

pharia-data-sdk (>=0.1.1, <=0.1.6), pharia-inference-sdk (>=0.1.2, <=0.1.6) +1 more potentially affected by CVE-2026-45017 via python-liquid (1.9.4)

python-liquid PYPI version 1.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - pharia-data-sdk =0.1.1, =0.1.2, =0.1.0, =0.1.7 Source cves: CVE-2026-45017 Source advisory: OSV:PYSEC-2026-192...

python-fhir-converter (>=0.1.0, <=0.3.0) potentially affected by CVE-2026-45017 via python-liquid (1.12.1)

python-liquid PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - python-fhir-converter =0.1.0, =0.3.0 Source cves: CVE-2026-45017 Source advisory: OSV:PYSEC-2026-192...

pharia-inference-sdk (0.1.0), solace-agent-mesh (>=1.8.0, <=1.26.0) potentially affected by CVE-2026-45017 via python-liquid (>=2.0.2, <=2.1.0)

python-liquid PYPI version =2.0.2, =1.8.0, =1.26.0 Source cves: CVE-2026-45017 Source advisory: OSV:PYSEC-2026-192...

plainqafact (>=0.4.0, <=1.1.0), python-fhir-converter (0.0.21) potentially affected by CVE-2026-45017 via python-liquid (1.10.2)

python-liquid PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - plainqafact =0.4.0, =1.1.0 - python-fhir-converter 0.0.21 Source cves: CVE-2026-45017 Source advisory: OSV:PYSEC-2026-192...

python-fhir-converter (0.0.22) potentially affected by CVE-2026-45017 via python-liquid (1.11.0)

python-liquid PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - python-fhir-converter 0.0.22 Source cves: CVE-2026-45017 Source advisory: OSV:PYSEC-2026-192...

blrec (>=1.8.0a3, <=2.0.0b5), dagster-looker (>=0.26.6rc0, <=0.29.21) +2 more potentially affected by CVE-2026-45017 via python-liquid (1.13.0)

python-liquid PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - blrec =1.8.0a3, =0.26.6rc0, =0.8.0, =0.0.1, =0.0.20 Source cves: CVE-2026-45017 Source advisory: OSV:PYSEC-2026-192...

PYSEC-2026-192

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and...

PYSEC-2026-192

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and...

PYSEC-0000-CVE-2026-45017

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and...

CVE-2026-45017 Python Liquid: Absolute paths escape filesystem loader search path

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and...