EUVD-2026-63089Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication or interaction needed; infinite loop yields high availability impact only, with no scope change or confidentiality/integrity effects.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In strip_html, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a<. This issue is fixed in version 10.27.1.
AnalysisAI
Infinite-loop denial of service in LiquidJS affects the strip_html filter across versions 10.26.0 through 10.27.0, allowing any caller who can supply template input to permanently block rendering with a string as short as two characters. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects that no authentication or special configuration is needed when the rendering endpoint accepts external input. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target application to use LiquidJS version 10.26.0 through 10.27.0 and to render templates that include user-controlled or externally supplied strings passed through the strip_html filter. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N accurately captures the exploitation ease - the attack is fully automatable, requiring only a two-character string to trigger an infinite loop in any exposed rendering endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade LiquidJS to version 10.27.1 or later, which resolves the issue via the fix in commit 5c3522f33928aae66f0fe85c36e1d9015c768fe2 (PR #917); the release is available at https://github.com/harttle/liquidjs/releases/tag/v10.27.1 and the security advisory at https://github.com/harttle/liquidjs/security/advisories/GHSA-m7fp-h3p4-hr49. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all LiquidJS 10.26.0-10.27.0 deployments and assess exposure: this vulnerability requires no authentication or special configuration-only that the system accepts external template input. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unbounded memory allocation in LiquidJS pop filter (prior to 10.27.1) allows remote attackers to exhaust server memory b
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False
Memory accounting bypass in LiquidJS prior to 10.27.2 enables remote denial of service by exhausting V8 heap or process
liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. versions up to 10.25.0 is affected b
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today