EUVD-2026-20611
GHSA-v273-448j-v4qj
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Although CVSS and EPSS scores are not provided, the vulnerability presents moderate-to-high real-world risk. The attack vector is network-accessible if the application exposes template rendering via HTTP endpoints; attack complexity is low (absolute path traversal requires no special conditions). The technical impact is confidentiality breach - arbitrary file disclosure readable by the Node.js process - with no integrity or availability impact. SSVC signals indicate this is exploitable with high certainty: the proof-of-concept is straightforward, the bug is triggered by direct API misuse (not a race condition or complex state), and affected applications must explicitly pass attacker-controlled filenames to renderFile()/parseFile(). This is not a zero-day; the vulnerability was disclosed responsibly via GitHub advisory. The vendor patch (v10.25.5) is available, reducing the window of exposure for proactive teams. Applications that do not treat root as a security boundary, or that do not forward user input into these APIs, face lower risk. |
| Exploit ScenarioDerived | A web application uses liquidjs to render user-supplied template filenames from HTTP request parameters. An attacker crafts a request with renderFile('/etc/passwd') or renderFile('../../../etc/hosts'), and the vulnerable liquidjs instance resolves the absolute path or traversal without validating containment within the configured root directory. The application returns the contents of the sensitive file to the attacker, leaking credentials, configuration details, or system information. This scenario requires the application to pass untrusted filenames directly into renderFile() without additional validation, a common pattern in template-as-a-service or dynamic template loading architectures. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Path traversal in liquidjs 10.25.0 allows local file disclosure when renderFile() or parseFile() receives absolute paths or traversal sequences, despite the root parameter being documented as a sandbox boundary. An attacker controlling template filenames passed to these APIs can read arbitrary files accessible to the Node.js process, such as /etc/hosts or sensitive configuration files. The vulnerability affects liquidjs versions prior to 10.25.5; a vendor-released patch is available. No public exploit code or active exploitation has been identified at the time of analysis.
RemediationAI
Upgrade liquidjs to version 10.25.5 or later immediately. This patched version enforces the same root containment checks for top-level renderFile() and parseFile() calls as it does for partial and layout lookups. Verify the upgrade via npm audit or package-lock.json. In the interim, if upgrading is blocked, validate and sanitize all template filenames passed to renderFile() and parseFile() to reject absolute paths and traversal sequences (e.g., reject /*, ../, or leading slashes). However, such input filtering is not a substitute for the vendor fix. See GitHub PR #870 and commit f41c1fc02fe901598f3328118b42b13bc6bc9b04 for technical details of the patch. Refer to the full advisory at https://github.com/harttle/liquidjs/security/advisories/GHSA-v273-448j-v4qj.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
liquidjs is a JavaScript/TypeScript implementation of the Liquid template engine commonly used in Node.js applications. The root cause lies in inconsistent path containment enforcement across the file-loading code path. When renderFile() or parseFile() is invoked, the parser calls loader.lookup() with LookupType.Root, which skips the enforceRoot check present in partial/layout lookups (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). The loader's candidates() function at src/fs/loader.ts:47-66 accepts resolved absolute paths and fallback results without verifying they remain within the configured root directory. This differs from CVE-2026-30952 (March 10, 2026), which hardened the include, render, and layout directives but overlooked top-level file-loading APIs. The vulnerability is present in the npm package liquidjs (CPE: pkg:npm/liquidjs) across affected versions.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (https://github.com/harttle/liquidjs) · only source for this CVE.
CVSS VectorVendor: https://github.com/harttle/liquidjs
Lifecycle Timeline
2DescriptionCVE.org
liquidjs 10.25.0 documents root as constraining filenames passed to renderFile() and parseFile(), but top-level file loads do not enforce that boundary.
The published npm package liquidjs@10.25.0 on Linux 6.17.0 with Node v22.22.1. A Liquid instance configured with an empty temporary directory as root still returned the contents of /etc/hosts when renderFile('/etc/hosts') was called. I have not exhaustively checked older releases yet; 10.25.0 is the latest tested version.
Root cause:
src/parser/parser.ts:83-85callsloader.lookup(file, LookupType.Root, ...)and then reads the returned file.src/fs/loader.ts:38passestype !== LookupType.Rootintocandidates().- For
LookupType.Root,enforceRootis false, sosrc/fs/loader.ts:47-66accepts resolved absolute paths and fallback results without anycontains()check.
This appears adjacent to the March 10, 2026 fix for CVE-2026-30952, which hardened include / render / layout but not the top-level file-loading APIs.
Proof of concept:
const fs = require('fs');
const os = require('os');
const path = require('path');
const { Liquid } = require('liquidjs');
const safeRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'liquidjs-safe-root-'));
const engine = new Liquid({ root: [safeRoot], extname: '.liquid' });
engine.renderFile('/etc/hosts').then(console.log);Expected result: a path outside root should be rejected. Actual result: /etc/hosts is rendered successfully.
Impact: any application that treats root as a sandbox boundary and forwards attacker-controlled template names into renderFile() or parseFile() can disclose arbitrary local files readable by the server process.
Suggested fix: apply the same containment checks used for partial/layout lookups to LookupType.Root, and reject absolute or fallback paths unless they remain within an allowed root. A regression test should verify that renderFile('/etc/hosts') fails when root points to an unrelated directory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Related Vulnerabilities in LiquidJS Path Traversal and Memory Issues
View all 3Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB