LiquidJS versions before 10.25.4 contain a vulnerability where the sort_natural filter bypasses the ownPropertyOnly security option. This bypass enables template authors to extract values from prototype-inherited properties via a sorting side-channel attack. Applications that use ownPropertyOnly: true to restrict property access, especially in multi-tenant environments, may inadvertently disclose sensitive prototype properties including API keys and tokens. The vulnerability is addressed in version 10.25.4 of LiquidJS.

The vulnerability allows unauthorized actors to access sensitive prototype-inherited properties in LiquidJS templates, potentially exposing confidential information such as API keys and tokens. This exposure could compromise security boundaries in multi-tenant template systems. There is no indication of impact on integrity or availability, and no known exploits have been reported.

Upgrade LiquidJS to version 10.25.4 or later, where this vulnerability is fixed. Since no official remediation level or patch links are provided beyond this version update, applying this version is the recommended action. Patch status is not explicitly confirmed beyond the stated fix version, so verify with the vendor advisory for the latest remediation guidance.