liquidjs (npm)
Advisories
21
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 10.27.2 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install liquidjs@10.27.2yarn
yarn add liquidjs@10.27.2pnpm
pnpm add liquidjs@10.27.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-fwxr-j5w2-587m LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration |
Medium EPSS 0.41% |
< 10.27.2 | 10.27.2 |
| GHSA-4r6h-5v86-94p3 LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process |
High EPSS 0.63% |
< 10.27.2 | 10.27.2 |
| GHSA-m7fp-h3p4-hr49 LiquidJS has an infinite loop vulnerability in its `strip_html` filter |
High EPSS 0.52% |
>= 10.26.0, < 10.27.1 | 10.27.1 |
| GHSA-g357-x5c3-c72p LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce |
High EPSS 0.49% |
< 10.27.1 | 10.27.1 |
| GHSA-gf2q-c269-pqgc LiquidJS is Vulnerable to Remote Code Execution |
Critical EPSS 0.82% |
< 10.26.0 | 10.26.0 |
| GHSA-r7g9-xpmj-5fcq LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex |
High EPSS 0.46% |
< 10.26.0 | 10.26.0 |
| GHSA-hh27-hf48-9f5q LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) |
High EPSS 0.39% |
<= 10.25.7 | No fix yet |
| GHSA-hh27-hf48-9f5q LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) |
High EPSS 0.39% |
< 10.26.0 | 10.26.0 |
| GHSA-9x9p-qf8f-mvjg LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()` |
Medium EPSS 0.33% |
< 10.26.0 | 10.26.0 |
| GHSA-8xx9-69p8-7jp3 LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body |
Medium EPSS 0.39% |
< 10.26.0 | 10.26.0 |
| GHSA-2qv6-9wx5-cwv4 LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS |
Medium EPSS 0.25% |
< 10.26.0 | 10.26.0 |
| GHSA-4rc3-7j7w-m548 liquidjs has a Denial of Service via circular block reference in layout |
Medium EPSS 0.38% |
< 10.25.7 | 10.25.7 |
| GHSA-v273-448j-v4qj LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read |
High EPSS 0.45% |
< 10.25.5 | 10.25.5 |
| GHSA-rv5g-f82m-qrvv LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel |
High EPSS 0.40% |
< 10.25.4 | 10.25.4 |
| GHSA-56p5-8mhr-2fph LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates |
High EPSS 0.40% |
< 10.25.3 | 10.25.3 |
| GHSA-mmg9-6m6j-jqqx LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter |
Medium EPSS 0.50% |
< 10.25.3 | 10.25.3 |
| GHSA-6q5m-63h6-5x4v LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern |
High EPSS 0.48% |
< 10.25.1 | 10.25.1 |
| GHSA-6q5m-63h6-5x4v LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern |
High EPSS 0.48% |
< 10.25.1 | 10.25.1 |
| GHSA-9r5m-9576-7f6x LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash |
High EPSS 0.41% |
<= 10.24.0 | No fix yet |
| GHSA-wmfp-5q7x-987x liquidjs has a path traversal fallback vulnerability |
High EPSS 0.58% |
< 10.25.0 | 10.25.0 |
| GHSA-45rm-2893-5f49 liquidjs may leak properties of a prototype |
Medium EPSS 1.01% |
< 10.0.0 | 10.0.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor