harttle liquidjs vulnerabilities

Newest CVEs

• CVE-2026-106120

  LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

  harttle · liquidjs

  Medium6.0
• CVE-2026-69222

  LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

  harttle · liquidjs

  High7.5
• CVE-2026-61556

  LiquidJS: An infinite loop vulnerability in `strip_html` filter

  harttle · liquidjs

  High8.7
• CVE-2026-45618

  LiquidJS is Vulnerable to Remote Code Execution

  harttle · liquidjs

  Critical10.0
• CVE-2026-55575

  LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

  harttle · liquidjs

  High8.2
• CVE-2026-45357

  LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime)

  harttle · liquidjs

  High7.5
• CVE-2026-44646

  LiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`

  harttle · liquidjs

  Medium5.3
• CVE-2026-45617

  LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex

  harttle · liquidjs

  High7.5
• CVE-2026-44645

  LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

  harttle · liquidjs

  Medium6.5
• CVE-2026-44644

  LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS

  harttle · liquidjs

  Medium6.1