liquidjs vulnerabilities
CVEs whose affected-version data names the liquidjs package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
9 CVEsRSS
CVE-2026-106120Medium· 6.0PoCLiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first fil…
CVE-2026-69222High· 7.5LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from array.length and separator length instead of the total string length p…
CVE-2026-61556HighLiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least on…
CVE-2026-55575HighLiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
CVE-2026-45357High· 7.5LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)
LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)
CVE-2026-44645Medium· 6.5LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
CVE-2026-44644Medium· 6.1LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
CVE-2026-44646Medium· 5.3LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
CVE-2026-33287High· 7.5LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern