What’s Vulnerable › Products
harttle liquidjs vulnerabilities
19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 18 published in the last 12 months.
Check whether your harttle liquidjs version is affected
Latest harttle liquidjs vulnerabilities
- CVE-2026-106120 — LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration (CVSS 6.0)
- CVE-2026-69222 — LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process (CVSS 7.5)
- CVE-2026-61556 — LiquidJS: An infinite loop vulnerability in `strip_html` filter (CVSS 8.7)
- CVE-2026-45618 — LiquidJS is Vulnerable to Remote Code Execution (CVSS 10.0)
- CVE-2026-55575 — LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce (CVSS 8.2)
- CVE-2026-45617 — LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex (CVSS 7.5)
- CVE-2026-45357 — LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime) (CVSS 7.5)
- CVE-2026-44646 — LiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()` (CVSS 5.3)
- CVE-2026-44645 — LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body (CVSS 6.5)
- CVE-2026-44644 — LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS (CVSS 6.1)
- CVE-2026-41311 — LiquidJS is vulnerable to Denial of Service via circular block reference in layout (CVSS 6.5)
- CVE-2026-39859 — LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read (CVSS 7.5)
- CVE-2026-39412 — LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel (CVSS 7.5)
- CVE-2026-35525 — LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates (CVSS 7.5)
- CVE-2026-34166 — LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter (CVSS 5.3)
- CVE-2026-33287 — LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern (CVSS 7.5)
- CVE-2026-33285 — LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash (CVSS 7.5)
- CVE-2026-30952 — liquidjs has a path traversal fallback vulnerability (CVSS 7.5)
- CVE-2022-25948 — Information Exposure (CVSS 5.3)