EUVD-2026-42354Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because the app must expose the pop filter over an attacker-sizable array; availability-only impact (A:H, C/I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filter at src/filters/array.ts allocated a full clone of its input array via [...toArray(v)] without calling this.context.memoryLimit.use(...), allowing a template render such as {{ huge_array | pop }} to allocate an O(N) clone of an attacker-influenced array outside the configured memoryLimit budget. This issue is fixed in version 10.27.1.
AnalysisAI
{{ huge_array | pop }} trigger an O(N) full clone of an attacker-influenced array that bypasses the engine's configured memoryLimit budget, enabling denial of service through memory exhaustion. The pop array filter in src/filters/array.ts clones its input via [...toArray(v)] without routing the allocation through this.context.memoryLimit.use(...), so the safety guard applications rely on is silently defeated. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the host application render a Liquid template that pipes an attacker-influenced array through the `pop` filter (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H, base 8.2) captures a network-reachable, no-privilege, no-interaction availability-only impact, but with AT:P - an attack requirement - reflecting that exploitation is not universal: the hosting application must actually expose the `pop` filter over an attacker-influenced array. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An application renders Liquid templates that apply the `pop` filter to an array whose size an attacker can influence (for example a list built from request parameters, uploaded data, or a database field the attacker controls). The attacker submits input that inflates the array to a very large size, causing the render to allocate a full O(N) clone outside the memoryLimit budget and exhaust process memory, crashing or stalling the service. … |
| Remediation | Vendor-released patch: upgrade LiquidJS to version 10.27.1, which routes the `pop` filter's array clone through the memoryLimit accounting; obtain it from the release at https://github.com/harttle/liquidjs/releases/tag/v10.27.1 and review the advisory at https://github.com/harttle/liquidjs/security/advisories/GHSA-g357-x5c3-c72p and PR https://github.com/harttle/liquidjs/pull/907. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify operational dependencies on the pop array filter; if feasible, disable the filter or restrict its use to non-critical paths. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False
liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. versions up to 10.25.0 is affected b
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today