Threat Intelligence Database

CVE-2026-45357 is a high-severity vulnerability in harttle liquidjs, a JavaScript template engine. Versions 10.25.7 and below have an uncontrolled resource consumption issue in the date filter's strftime implementation. Specifically, large width specifiers like %9999999d cause unbounded string padding operations that bypass documented memory and render limits. This can lead to excessive memory use, high CPU consumption, or out-of-memory crashes during template rendering. The issue is fixed in version 10.26.0.

LiquidJS versions 10.25.7 and below contain a vulnerability where the renderLimit option intended to limit rendering time can be bypassed by using an empty {% for %} or {% tablerow %} loop body. This allows an attacker to cause uncontrolled resource consumption by iterating large collections without triggering the time limit, potentially stalling the Node.js event loop and impacting availability. The issue has been fixed in version 10.26.0.

LiquidJS versions 10.25.7 and below contain a cross-site scripting (XSS) vulnerability in the strip_html filter. The filter uses a regex that fails to match line terminators inside HTML tags, allowing tags with newline characters to bypass sanitization. This can lead to execution of attacker-controlled scripts when rendering unescaped output. The issue is fixed in version 10.26.0.