What’s Vulnerable › Vulnerabilities

CVE-2026-30952: liquidjs has a path traversal fallback vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-10 · updated 2026-06-17
• Weakness: CWE-22

Description

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0.

Affected products

• harttle liquidjs: before 10.25.0 — fixed in 10.25.0

How to fix

Upgrade to a fixed version: harttle liquidjs 10.25.0. Check the vendor advisory for mitigations.

References

• https://github.com/harttle/liquidjs/commit/3cd024d652dc883c46307581e979fe32302adbac
• https://github.com/harttle/liquidjs/pull/851
• https://github.com/harttle/liquidjs/pull/855
• https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x

Get alerted when CVE-2026-30952 or the next vulnerability affects your stack