| LiquidJS has Exponential Memory Amplification through its replace_first Filter $& PatternCVE-2026-33287 · GHSA-6Q5M-63H6-5X4V |
liquidjs |
npm |
High
|
Fix reported |
|
| LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)CVE-2026-45357 · GHSA-HH27-HF48-9F5Q |
liquidjs |
npm |
High
|
Fix reported |
|
| LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` bodyCVE-2026-44645 · GHSA-8XX9-69P8-7JP3 |
liquidjs |
npm |
Medium
|
Fix reported |
|
| LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSSCVE-2026-44644 · GHSA-2QV6-9WX5-CWV4 |
liquidjs |
npm |
Medium
|
Fix reported |
|
| LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`CVE-2026-44646 · GHSA-9X9P-QF8F-MVJG |
liquidjs |
npm |
Medium
|
Fix reported |
|
| LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iterationCVE-2026-106120 · GHSA-FWXR-J5W2-587M |
liquidjs |
npm |
Medium
|
Fix reported |
|
| LiquidJS is Vulnerable to Remote Code ExecutionCVE-2026-45618 · GHSA-GF2Q-C269-PQGC |
liquidjs |
npm |
Critical
|
Fix reported |
|
| LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channelCVE-2026-39412 · GHSA-RV5G-F82M-QRVV |
liquidjs |
npm |
Medium
|
Fix reported |
|
| LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` FilterCVE-2026-34166 · GHSA-MMG9-6M6J-JQQX |
liquidjs |
npm |
Low
|
Fix reported |
|
| LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter RegexCVE-2026-45617 · GHSA-R7G9-XPMJ-5FCQ |
liquidjs |
npm |
High
|
Fix reported |
|
| LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file readCVE-2026-39859 · GHSA-V273-448J-V4QJ |
liquidjs |
npm |
Medium
|
Fix reported |
|
| liquidjs has a Denial of Service via circular block reference in layoutCVE-2026-41311 · GHSA-4RC3-7J7W-M548 |
liquidjs |
npm |
High
|
Fix reported |
|
| LiquidJS: Root restriction bypass for partial and layout loading through symlinked templatesCVE-2026-35525 · GHSA-56P5-8MHR-2FPH |
liquidjs |
npm |
High
|
Fix reported |
|
| liquidjs has a path traversal fallback vulnerabilityCVE-2026-30952 · GHSA-WMFP-5Q7X-987X |
liquidjs |
npm |
High
|
Fix reported |
|
| LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the processCVE-2026-69222 · GHSA-4R6H-5V86-94P3 |
liquidjs |
npm |
High
|
Fix reported |
|
| LiquidJS has an infinite loop vulnerability in its `strip_html` filterCVE-2026-61556 · GHSA-M7FP-H3P4-HR49 |
liquidjs |
npm |
High
|
Fix reported |
|
| LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforceCVE-2026-55575 · GHSA-G357-X5C3-C72P |
liquidjs |
npm |
High
|
Fix reported |
|
| LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process CrashCVE-2026-33285 · GHSA-9R5M-9576-7F6X |
liquidjs |
npm |
High
|
No fix reported |
|
| liquidjs may leak properties of a prototypeCVE-2022-25948 · GHSA-45RM-2893-5F49 |
liquidjs |
npm |
Medium
|
Fix reported |
|
