Skip to main content

LiquidJS CVE-2026-55575

| EUVDEUVD-2026-42354 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-07-08 GitHub_M
Denial Of Service Liquidjs
8.2
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because the app must expose the pop filter over an attacker-sizable array; availability-only impact (A:H, C/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jul 08, 2026 - 21:04 EUVD
Analysis Generated
Jul 08, 2026 - 20:34 vuln.today
CVE Published
Jul 08, 2026 - 19:32 cve.org
HIGH 8.2

DescriptionCVE.org

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filter at src/filters/array.ts allocated a full clone of its input array via [...toArray(v)] without calling this.context.memoryLimit.use(...), allowing a template render such as {{ huge_array | pop }} to allocate an O(N) clone of an attacker-influenced array outside the configured memoryLimit budget. This issue is fixed in version 10.27.1.

AnalysisAI

{{ huge_array | pop }} trigger an O(N) full clone of an attacker-influenced array that bypasses the engine's configured memoryLimit budget, enabling denial of service through memory exhaustion. The pop array filter in src/filters/array.ts clones its input via [...toArray(v)] without routing the allocation through this.context.memoryLimit.use(...), so the safety guard applications rely on is silently defeated. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify template rendering endpoint using pop filter
Delivery
Supply oversized attacker-controlled array
Exploit
Trigger unbudgeted O(N) array clone
Execution
Exhaust process memory outside memoryLimit
Impact
Denial of service / service crash
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the host application render a Liquid template that pipes an attacker-influenced array through the `pop` filter (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H, base 8.2) captures a network-reachable, no-privilege, no-interaction availability-only impact, but with AT:P - an attack requirement - reflecting that exploitation is not universal: the hosting application must actually expose the `pop` filter over an attacker-influenced array. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An application renders Liquid templates that apply the `pop` filter to an array whose size an attacker can influence (for example a list built from request parameters, uploaded data, or a database field the attacker controls). The attacker submits input that inflates the array to a very large size, causing the render to allocate a full O(N) clone outside the memoryLimit budget and exhaust process memory, crashing or stalling the service. …
Remediation Vendor-released patch: upgrade LiquidJS to version 10.27.1, which routes the `pop` filter's array clone through the memoryLimit accounting; obtain it from the release at https://github.com/harttle/liquidjs/releases/tag/v10.27.1 and review the advisory at https://github.com/harttle/liquidjs/security/advisories/GHSA-g357-x5c3-c72p and PR https://github.com/harttle/liquidjs/pull/907. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify operational dependencies on the pop array filter; if feasible, disable the filter or restrict its use to non-critical paths. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Liquidjs

View all
CVE-2022-25948 MEDIUM POC
5.3 Dec 22

The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False
CVE-2026-30952 HIGH
7.5 Mar 10

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. versions up to 10.25.0 is affected b

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8
CVE-2023-38507 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-55575 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy