Skip to main content
cve.nowby Sazabi
← npm
npmPackage

liquidjs

19 known vulnerabilities (1 critical, 10 high, 7 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
10.30.1 (Oct 28, 2026): no advisory affects it
Newest unaffected release
10.30.1 (Oct 28, 2026), the latest release
Advisories
19 · 1 critical, 10 high, 7 medium, 1 low
Weekly downloads
3.4M
Dependents
1,110
Releases
236 since 1.9.1 (Jul 16, 2017)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 19 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 19

  • CVE-2026-106120Medium 6.0

    LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

    Affected: fixed in 10.27.2.

    Fixed in 10.27.2 (released Jul 9, 2026, 89 days before disclosure).

    The latest release, 10.30.1, is not affected.

    36% of liquidjs downloads last week were affected versions (1.3M).

  • LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

    Affected: fixed in 10.27.2.

    Fixed in 10.27.2 (released Jul 9, 2026, 41 days before disclosure).

    The latest release, 10.30.1, is not affected.

    36% of liquidjs downloads last week were affected versions (1.3M).

  • LiquidJS: An infinite loop vulnerability in `strip_html` filter

    Affected: from 10.26.0, fixed in 10.27.1.

    Fixed in 10.27.1 (released Jun 23, 2026, 57 days before disclosure).

    The latest release, 10.30.1, is not affected.

    6.2% of liquidjs downloads last week were affected versions (229.3K).

  • CVE-2026-45618Critical 10.0

    LiquidJS is Vulnerable to Remote Code Execution

    Affected: fixed in 10.26.0.

    Fixed in 10.26.0 (released May 14, 2026, 89 days before disclosure).

    The latest release, 10.30.1, is not affected.

    26% of liquidjs downloads last week were affected versions (960K).

  • LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

    Affected: fixed in 10.27.1.

    Fixed in 10.27.1 (released Jun 23, 2026, 15 days before disclosure).

    The latest release, 10.30.1, is not affected.

    32% of liquidjs downloads last week were affected versions (1.2M).

  • LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime)

    Affected: fixed in 10.26.0.

    Fixed in 10.26.0 (released May 14, 2026, 34 days before disclosure).

    The latest release, 10.30.1, is not affected.

    26% of liquidjs downloads last week were affected versions (960K).

  • CVE-2026-44646Medium 5.3

    LiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`

    Affected: fixed in 10.26.0.

    Fixed in 10.26.0 (released May 14, 2026, 34 days before disclosure).

    The latest release, 10.30.1, is not affected.

    26% of liquidjs downloads last week were affected versions (960K).

  • LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex

    Affected: fixed in 10.26.0.

    Fixed in 10.26.0 (released May 14, 2026, 34 days before disclosure).

    The latest release, 10.30.1, is not affected.

    26% of liquidjs downloads last week were affected versions (960K).

  • CVE-2026-44645Medium 6.5

    LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

    Affected: fixed in 10.26.0.

    Fixed in 10.26.0 (released May 14, 2026, 34 days before disclosure).

    The latest release, 10.30.1, is not affected.

    26% of liquidjs downloads last week were affected versions (960K).

  • CVE-2026-44644Medium 6.1

    LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS

    Affected: fixed in 10.26.0.

    Fixed in 10.26.0 (released May 14, 2026, 34 days before disclosure).

    The latest release, 10.30.1, is not affected.

    26% of liquidjs downloads last week were affected versions (960K).

  • LiquidJS is vulnerable to Denial of Service via circular block reference in layout

    Affected: fixed in 10.25.7.

    Fixed in 10.25.7 (released Apr 23, 2026, 16 days before disclosure).

    The latest release, 10.30.1, is not affected.

    25% of liquidjs downloads last week were affected versions (913.6K).

  • CVE-2026-39859Medium 6.3

    LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read

    Affected: fixed in 10.25.5.

    Fixed in 10.25.5 (released Apr 7, 2026, 1 day before disclosure).

    The latest release, 10.30.1, is not affected.

    24% of liquidjs downloads last week were affected versions (886.8K).

  • CVE-2026-39412Medium 5.3

    LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel

    Affected: fixed in 10.25.4.

    Fixed in 10.25.4 (released Apr 7, 2026, 1 day before disclosure).

    The latest release, 10.30.1, is not affected.

    24% of liquidjs downloads last week were affected versions (886.5K).

  • LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates

    Affected: fixed in 10.25.3.

    Fixed in 10.25.3 (released Apr 6, 2026, 2 days before disclosure).

    The latest release, 10.30.1, is not affected.

    24% of liquidjs downloads last week were affected versions (882.9K).

  • LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter

    Affected: fixed in 10.25.3.

    Fixed in 10.25.3 (released Apr 6, 2026, 2 days before disclosure).

    The latest release, 10.30.1, is not affected.

    24% of liquidjs downloads last week were affected versions (882.9K).

Show all 19 advisoriesShow fewer advisories

  • LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash

    Affected: through 10.24.0.

    Fixed in 10.25.0 (released Mar 7, 2026, 19 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 10.30.1, is not affected.

    21% of liquidjs downloads last week were affected versions (782.7K).

  • LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern

    Affected: fixed in 10.25.1.

    Fixed in 10.25.1 (released Mar 22, 2026, 4 days before disclosure).

    The latest release, 10.30.1, is not affected.

    22% of liquidjs downloads last week were affected versions (817.2K).

  • liquidjs has a path traversal fallback vulnerability

    Affected: fixed in 10.25.0.

    Fixed in 10.25.0 (released Mar 7, 2026, 3 days before disclosure).

    The latest release, 10.30.1, is not affected.

    21% of liquidjs downloads last week were affected versions (782.7K).

  • CVE-2022-25948Medium 5.3

    Information Exposure

    Affected: fixed in 10.0.0.

    Fixed in 10.0.0 (released Nov 27, 2022, 26 days before disclosure).

    The latest release, 10.30.1, is not affected.

    2.8% of liquidjs downloads last week were affected versions (105.2K).