LiquidJS versions prior to 10.25.3 have an uncontrolled resource consumption vulnerability (CWE-400) in the replace filter. When the memoryLimit option is enabled, the memory usage is underestimated because it only accounts for the lengths of the input string, pattern, and replacement string. However, the actual output size from str.split(pattern).join(replacement) can be quadratically larger if the pattern occurs frequently, enabling an attacker to bypass memory limits with approximately 2,500 times amplification. This can lead to out-of-memory conditions and denial-of-service. The issue is resolved in LiquidJS 10.25.3.

An attacker who can control template content may exploit this vulnerability to cause excessive memory consumption, potentially leading to denial-of-service due to out-of-memory conditions. The CVSS score is 3.7 (low severity), reflecting limited impact as it requires control over template content and has a high attack complexity.

Upgrade LiquidJS to version 10.25.3 or later, where this vulnerability is fixed. No other mitigation is indicated or required according to the available data.