In LiquidJS, a JavaScript template engine, the Context.spawn() method creates a child context for the {% render %} tag but fails to propagate the parent context's resolved ownPropertyOnly value. Instead, it derives ownPropertyOnly from the instance-level option opts.ownPropertyOnly, ignoring any override supplied to parseAndRender(). This results in a silent bypass where prototype-chain properties can leak from untrusted renders using {% render %} partials, even if ownPropertyOnly:true is specified at render time. This vulnerability is distinct from previously known array-filter related issues but shares the same root cause in Context.spawn(). The vulnerability affects versions up to 10.25.7 and was fixed in version 10.26.0.

An attacker can cause prototype-chain properties to leak during template rendering with the {% render %} tag, bypassing intended property access restrictions. This may expose sensitive internal data from the JavaScript prototype chain. The vulnerability does not affect integrity or availability but impacts confidentiality of rendered data.

Upgrade to LiquidJS version 10.26.0 or later, where this issue is fixed. Since no official patch or temporary fix is indicated beyond this version update, applying the upgrade is the recommended remediation.