Threats affecting pkg:npm/liquidjs

CVE-2026-106120 is a vulnerability in the LiquidJS template engine where the ownPropertyOnly setting does not fully prevent access to inherited array elements through certain operations like negative indexing and filters. This can lead to exposure of sensitive information from prototype-inherited data. The issue is fixed in version 10.27.2.

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filter at src/filters/array.ts allocated a full clone of its input array via [...toArray(v)] without calling this.context.memoryLimit.use(...), allowing a template render such as {{ huge_array | pop }} to allocate an O(N) clone of an attacker-influenced array outside the configured memoryLimit budget. This issue is fixed in version 10.27.1.

LiquidJS versions prior to 10.26.0 contain a vulnerability in the `date` filter's strftime implementation that allows unbounded width padding. This flaw bypasses the engine's memory and render limits by passing unchecked large width specifiers to a padding function, causing excessive memory allocation and CPU usage. An attacker can exploit this by supplying a crafted date format string, leading to denial of service via high resource consumption or process crash due to out-of-memory conditions. The vulnerability is fixed in version 10.26.0.

LiquidJS versions prior to 10.26.0 have a vulnerability in the {% render %} tag where the per-render option ownPropertyOnly:true is silently ignored inside partial templates. This occurs because Context.spawn() creates a child context that does not inherit the per-render ownPropertyOnly override, causing prototype-chain properties to be exposed inside partials even when locked down. This leads to information disclosure of prototype properties such as secrets or internal state. The issue is fixed in version 10.26.0.

LiquidJS versions prior to 10.26.0 contain a denial-of-service vulnerability where the renderLimit CPU time guard can be bypassed by using an empty {% for %} loop body. This allows a low-privileged template author to cause the Node.js event loop to be blocked for attacker-controlled durations, significantly exceeding the configured renderLimit. The vulnerability impacts availability but does not expose data or affect integrity. A fix is available in version 10.26.0.

The strip_html filter in liquidjs fails to remove HTML tags containing newline characters due to a regex limitation, allowing attackers to bypass sanitization and inject malicious HTML with event handlers. This leads to stored or reflected cross-site scripting (XSS) in applications that rely on strip_html without additional escaping. The flaw is fixed in version 10.26.0.

A vulnerability in LiquidJS versions prior to 10.25.4 allows template authors to bypass the ownPropertyOnly security option via the sort_natural filter. This enables unauthorized exposure of sensitive prototype-inherited properties, such as API keys and tokens, through a sorting side-channel attack. The issue is fixed in version 10.25.4.

CVE-2026-33285 is a high-severity vulnerability in the LiquidJS template engine prior to version 10.25.1. The issue involves improper input validation allowing the memoryLimit security mechanism to be bypassed using reverse range expressions. This can lead to unlimited memory allocation and a subsequent V8 fatal error that crashes the Node.js process, causing a denial of service. The vulnerability is patched in LiquidJS version 10.25.1.

LiquidJS versions prior to 10.25.1 contain a vulnerability in the replace_first filter where the use of JavaScript's String.prototype.replace() with the $& pattern leads to exponential memory amplification. The filter only accounts for the input string length against a memory limit, not the potentially much larger output string. An attacker can exploit this to cause denial of service by generating output strings hundreds of thousands of times larger than the input while staying within the memory limit.