Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/05/27 12:28 a.m.22 views

LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`

Summary Context.spawn in liquidjs creates a child Context for the % render % tag but does not propagate the parent context's resolved ownPropertyOnly value. The new context re-derives ownPropertyOnly from opts.ownPropertyOnly the instance-level option, silently discarding any...

5.3CVSS6AI score0.00271EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder