LiquidJS, a JavaScript template engine compatible with Shopify and GitHub Pages, has an XSS vulnerability (CWE-79) in versions 10.25.7 and earlier. The vulnerability arises from the strip_html filter's regex, which does not match line terminators inside HTML tags, allowing tags with newline characters to pass through unfiltered. Attackers can exploit this by injecting tags such as <img\nsrc=x\nonerror=alert(1)>, which browsers interpret as valid and execute event handlers. Exploitation requires the application to render attacker-controlled input using the vulnerable filter without additional HTML escaping. The vulnerability has a CVSS 3.1 score of 6.1 (medium severity) and is fixed in version 10.26.0.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected web application, potentially leading to information disclosure or user session compromise. The vulnerability specifically impacts applications that rely on the strip_html filter for XSS defense without enabling output escaping. There is no indication of known exploits in the wild.

Upgrade to LiquidJS version 10.26.0 or later, where this issue is fixed. Until then, avoid relying solely on the strip_html filter for XSS protection and ensure that output escaping is enabled when rendering untrusted input. Patch status is not explicitly stated but the fix is available in version 10.26.0.