CVE-2026-61556 is an infinite loop vulnerability (CWE-835) in the harttle LiquidJS template engine, specifically in the strip_html filter implemented in src/filters/html.ts. When the input string contains a '<' character preceded by at least one character and lacks a subsequent '>', the loop that searches for HTML tag boundaries fails to advance the loop index properly. This causes the loop to reprocess the same state indefinitely, blocking template rendering and enabling denial of service with minimal input such as 'a<'. The flaw affects versions >=10.26.0 and <10.27.1 and is resolved in version 10.27.1.

An attacker can cause the LiquidJS template engine to enter an infinite loop during template rendering by supplying crafted input strings that trigger the strip_html filter's faulty loop logic. This results in denial of service by blocking the rendering process. The vulnerability does not require privileges or user interaction and can be triggered remotely if the application processes untrusted input through LiquidJS.

Upgrade LiquidJS to version 10.27.1 or later, where this infinite loop issue in the strip_html filter is fixed. No other mitigation is required as the fix addresses the root cause directly.