Liquidjs
CVE-2026-30952
HIGH
GHSA-wmfp-5q7x-987x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious template with absolute path
-
ExploitSubmit to vulnerable liquidjs renderer
-
ExecutionAccess arbitrary files on server
-
ImpactExfiltrate sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | liquidjs versions before 10.25.0 with dynamicPartials enabled (default) or user-controlled template content; attacker must be able to inject layout, render, or include tags with absolute file paths into templates processed by the application |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. versions up to 10.25.0 is affected by path traversal.
RemediationAI
Fixed in version 10.25.0.. Validate and sanitize file path inputs. Use allowlists.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-22: Path Traversal) affects liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript.. liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0.
Know when Liquidjs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0.
Blast Radius
ecosystem impact- 36 npm packages depend on liquidjs (8 direct, 29 indirect)
Ecosystem-wide dependent count for version 10.25.0.
Executive ViewAI
Organizations using pure JavaScript. face notable risk from CVE-2026-30952, a path traversal vulnerability rated CVSS 7.5. This could allow attackers to access or modify files outside intended directories, potentially exposing sensitive configuration or credentials. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Restrict file upload functionality via WAF; (2) Implement allowlist-based file type validation; (3) Use chroot/containerization to limit filesystem access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)GitHub Advisory
Infinite-loop denial of service in LiquidJS affects the strip_html filter across versions 10.26.0 through 10.27.0, allow
Unbounded memory allocation in LiquidJS pop filter (prior to 10.27.1) allows remote attackers to exhaust server memory b
Memory accounting bypass in LiquidJS prior to 10.27.2 enables remote denial of service by exhausting V8 heap or process
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False
Information disclosure in LiquidJS versions prior to 10.27.2 lets an attacker read prototype-inherited array elements th
Exploit-DB