LiquidJS CVE-2026-61556

Exploitation requires the target application to use LiquidJS version 10.26.0 through 10.27.0 and to render templates that include user-controlled or externally supplied strings passed through the strip_html filter. The trigger condition is any string containing a '<' character preceded by at least one other character and lacking any subsequent '>' - a two-character input such as 'a<' is sufficient. Applications that do not pass untrusted input through strip_html, that sanitize or reject malformed angle-bracket sequences before template rendering, or that enforce per-request rendering timeouts are not at practical risk. The CVSS 4.0 vector (PR:N/UI:N) confirms that no authentication or user interaction is required when the rendering endpoint is network-accessible.

The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N accurately captures the exploitation ease - the attack is fully automatable, requiring only a two-character string to trigger an infinite loop in any exposed rendering endpoint. EPSS data is absent from the available intelligence, so exploitation probability cannot be quantified beyond the CVSS signal. No CISA KEV listing is recorded, and no independently confirmed external POC exists beyond the reproduction test cases included in patch PR #917, indicating that widespread opportunistic exploitation has not yet been observed. The impact is strictly an availability loss with no confidentiality or integrity consequences, which limits blast radius to service disruption; systems that validate or sanitize template input before rendering, or that run LiquidJS in isolated worker threads with timeouts, substantially reduce practical risk. The single-character fix already shipped in 10.27.1 makes remediation low-effort and low-risk, arguing for prompt patching over complex mitigations.

An attacker submits a crafted Liquid template string such as {{ "a<" | strip_html }} to a web application that renders user-supplied templates with LiquidJS 10.26.0-10.27.0. The strip_html filter enters an infinite loop, blocking the Node.js event loop or dedicated rendering thread. Repeated concurrent submissions of this trivial payload exhaust server capacity and deny service to legitimate users.