Threats tagged 'ghsa-2qv6-9wx5-cwv4'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.1	EPSS 0.3%	CVE-2026-44644 · LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS Medium6.1EPSS 0.3%2026-05-27GCVE Database The strip_html filter in liquidjs fails to remove HTML tags containing newline characters due to a regex limitation, allowing attackers to bypass sanitization and inject malicious HTML with event handlers. This leads to stored or reflected cross-site scripting (XSS) in applications that rely on strip_html without additional escaping. The flaw is fixed in version 10.26.0. EPSS 0.3%Report on CVE-2026-44644 Vulnerability CWE-79 #ghsa-2qv6-9wx5-cwv4 #npm	GCVE Database	2026-05-27

Page 1 of 1