Search for packages
| purl | pkg:npm/liquidjs@10.25.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-senw-hmwk-qqhj
Aliases: CVE-2026-41311 GHSA-4rc3-7j7w-m548 |
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap out of memory. This allows any user who can submit a Liquid template to perform a Denial of Service attack. This issue has been patched in version 10.25.7. |
Affected by 4 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-wvp4-x1cb-63d7 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, liquidjs 10.25.0 documents root as constraining filenames passed to renderFile() and parseFile(), but top-level file loads do not enforce that boundary. A Liquid instance configured with an empty temporary directory as root can return the contents of arbitrary files. This vulnerability is fixed in 10.25.3. |
CVE-2026-39859
GHSA-v273-448j-v4qj |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-13T06:28:51.209515+00:00 | GHSA Importer | Fixing | VCID-wvp4-x1cb-63d7 | https://github.com/advisories/GHSA-v273-448j-v4qj | 38.6.0 |
| 2026-06-12T22:12:45.407206+00:00 | GitLab Importer | Affected by | VCID-senw-hmwk-qqhj | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/liquidjs/CVE-2026-41311.yml | 38.6.0 |
| 2026-06-12T21:56:34.589830+00:00 | GitLab Importer | Fixing | VCID-wvp4-x1cb-63d7 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/liquidjs/CVE-2026-39859.yml | 38.6.0 |
| 2026-06-12T07:45:37.768011+00:00 | GithubOSV Importer | Fixing | VCID-wvp4-x1cb-63d7 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-v273-448j-v4qj/GHSA-v273-448j-v4qj.json | 38.6.0 |