Liquidjs
Monthly
Memory accounting bypass in LiquidJS prior to 10.27.2 enables remote denial of service by exhausting V8 heap or process memory limits through crafted templates. The join, array_to_sentence_string, json, and inspect filters computed resource consumption based on element count rather than actual output string length, allowing the concat filter to be chained to exponentially amplify array size without proportional memoryLimit charges. This CVE is not in CISA KEV and no standalone public exploit has been published, though the GitHub security advisory and fix PR #925 include working proof-of-concept integration tests that make the technique trivially reproducible.
Infinite-loop denial of service in LiquidJS affects the strip_html filter across versions 10.26.0 through 10.27.0, allowing any caller who can supply template input to permanently block rendering with a string as short as two characters. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects that no authentication or special configuration is needed when the rendering endpoint accepts external input. The issue is fixed in version 10.27.1 via a one-character patch; no public exploit code beyond the patch test cases has been confirmed, and no CISA KEV listing is recorded.
Unbounded memory allocation in LiquidJS pop filter (prior to 10.27.1) allows remote attackers to exhaust server memory by crafting template input that triggers a large array clone without respecting the configured memoryLimit. The vulnerability is automatable, has a publicly available proof-of-concept, but no active exploitation is currently reported.
liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. versions up to 10.25.0 is affected by path traversal.
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Memory accounting bypass in LiquidJS prior to 10.27.2 enables remote denial of service by exhausting V8 heap or process memory limits through crafted templates. The join, array_to_sentence_string, json, and inspect filters computed resource consumption based on element count rather than actual output string length, allowing the concat filter to be chained to exponentially amplify array size without proportional memoryLimit charges. This CVE is not in CISA KEV and no standalone public exploit has been published, though the GitHub security advisory and fix PR #925 include working proof-of-concept integration tests that make the technique trivially reproducible.
Infinite-loop denial of service in LiquidJS affects the strip_html filter across versions 10.26.0 through 10.27.0, allowing any caller who can supply template input to permanently block rendering with a string as short as two characters. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects that no authentication or special configuration is needed when the rendering endpoint accepts external input. The issue is fixed in version 10.27.1 via a one-character patch; no public exploit code beyond the patch test cases has been confirmed, and no CISA KEV listing is recorded.
Unbounded memory allocation in LiquidJS pop filter (prior to 10.27.1) allows remote attackers to exhaust server memory by crafting template input that triggers a large array clone without respecting the configured memoryLimit. The vulnerability is automatable, has a publicly available proof-of-concept, but no active exploitation is currently reported.
liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. versions up to 10.25.0 is affected by path traversal.
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.