LiquidJS versions before 10.27.2 have an uncontrolled resource consumption vulnerability (CWE-400) in the join filter and the array_to_sentence_string filter. These filters miscalculate the memory cost by accounting only for array length and separator length instead of the actual string length produced. Attackers can exploit this by crafting templates that cause the concat filter to duplicate arrays cheaply, leading to excessive memory allocation and potential process crashes. The vulnerability is addressed in version 10.27.2.

An attacker can craft templates that cause the LiquidJS engine to allocate memory beyond configured limits, potentially exhausting V8's string or process memory and crashing the application. This results in denial of service (DoS) without impacting confidentiality or integrity.

Upgrade to liquidjs version 10.27.2 or later, where this vulnerability is fixed. No other mitigation is required as the fix addresses the root cause.