LiquidJS CVE-2026-69222

Exploitation requires that the application passes user-supplied or attacker-controlled Liquid template content to a LiquidJS rendering context, and that the template can use the concat filter combined with join, array_to_sentence_string, json, or inspect filters on attacker-influenced data. The vulnerability is not exploitable through data injection into a fixed, operator-controlled template - the malicious filter chain must exist in the template itself. Setting memoryLimit does not prevent exploitation because the accounting defect causes the limit to be under-charged before it fires; there is no known safe memoryLimit value that blocks the attack without the patch. No authentication is required if the template submission endpoint is publicly accessible, consistent with the CVSS PR:N rating. Applications that render only static, operator-authored templates with no user-controlled template content are not exposed to this vulnerability.

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the threat model for applications that accept user-supplied Liquid templates. The availability-only impact (A:H with C:N/I:N) is consistent with the described crash-only outcome - the Node.js process terminates at V8 string or heap limits with no evidence of code execution or data disclosure. Low attack complexity and no-authentication vector are appropriate because the bypass requires only valid Liquid template syntax: no memory corruption, heap grooming, or brute-force element is needed. EPSS data was not provided in the input and cannot be inferred; exploitation probability is unknown beyond the CVSS signal. This CVE is not in CISA KEV, so active exploitation is not confirmed. Real-world impact depends heavily on whether the deployment exposes template rendering to untrusted input: applications rendering fixed, operator-controlled templates are unexposed, while platforms offering user-defined template execution - the primary Shopify storefront theme use case - are directly at risk and should treat this as urgent. The memoryLimit feature exists precisely to bound untrusted-template resource consumption, making this bypass a direct circumvention of the intended security control rather than a misuse of a non-security feature.

An attacker submits a crafted Liquid template to an application that renders user-supplied content, using concat to repeatedly double an array referencing a large string (e.g., 'a'.repeat(5000) split into a single-element array, then doubled three times via concat to yield eight references). The attacker then pipes the result through join, which materializes 40,000 characters of output while the memoryLimit accounting charges only eight units - a factor-5000 bypass. This process is repeatable with deeper concat chains until V8 string limits or process heap limits are exhausted, crashing the Node.js process. Working test cases demonstrating this technique are included in the fix PR's integration test suite.