LiquidJS, a JavaScript template engine compatible with Shopify and GitHub Pages, contained a resource allocation vulnerability (CWE-770) in versions before 10.27.1. Specifically, the pop array filter at src/filters/array.ts cloned its input array using [...toArray(v)] without invoking this.context.memoryLimit.use(...), thus bypassing memory usage limits. This flaw allows a template render such as {{ huge_array | pop }} to allocate an O(N) clone of an attacker-influenced array outside the configured memory budget, potentially causing denial of service due to excessive memory consumption. The issue is resolved in version 10.27.1.

An attacker can cause the application to allocate large amounts of memory by rendering templates that use the vulnerable pop filter on large arrays. This uncontrolled memory allocation can lead to denial of service conditions by exhausting system memory resources. There is no indication of privilege escalation or code execution from the provided data.

Upgrade to liquidjs version 10.27.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data.