EUVD-2026-42354
GHSA-g357-x5c3-c72p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because the app must expose the pop filter over an attacker-sizable array; availability-only impact (A:H, C/I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 9 npm packages depend on liquidjs (4 direct, 5 indirect)
Ecosystem-wide dependent count for version 10.27.1.
DescriptionCVE.org
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filter at src/filters/array.ts allocated a full clone of its input array via [...toArray(v)] without calling this.context.memoryLimit.use(...), allowing a template render such as {{ huge_array | pop }} to allocate an O(N) clone of an attacker-influenced array outside the configured memoryLimit budget. This issue is fixed in version 10.27.1.
AnalysisAI
Unbounded memory allocation in LiquidJS pop filter (prior to 10.27.1) allows remote attackers to exhaust server memory by crafting template input that triggers a large array clone without respecting the configured memoryLimit. The vulnerability is automatable, has a publicly available proof-of-concept, but no active exploitation is currently reported.
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False
Infinite-loop denial of service in LiquidJS affects the strip_html filter across versions 10.26.0 through 10.27.0, allow
Memory accounting bypass in LiquidJS prior to 10.27.2 enables remote denial of service by exhausting V8 heap or process
liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. versions up to 10.25.0 is affected b
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today