liquid-renderer (RubyGems) · Malicious Code
Affects liquid-rendererSource GCVE Database
Rated by Threat Radar
Data as of 19 Jul 2026, 00:02 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
RubyGemsliquid-rendererpkg:gem/liquid-rendererOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should avoid using 'liquid-renderer' version 5.0.1 and remove it from their environments if present. Monitor vendor or repository advisories for updates or removal of the malicious package. Since this is a malicious package incident, replacing the package with a trusted alternative or verifying package integrity before use is recommended.
Description
The RubyGems package 'liquid-renderer' version 5.0.1 contains malicious code. This is a supply chain threat where the package itself is intentionally harmful. No CVSS score is provided, and no official patch or remediation guidance is currently available.