What’s Vulnerable › Vulnerabilities

CVE-2026-39412: LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-08 · updated 2026-07-24
• Weakness: CWE-200

Description

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.4, the sort_natural filter bypasses the ownPropertyOnly security option, allowing template authors to extract values of prototype-inherited properties through a sorting side-channel attack. Applications relying on ownPropertyOnly: true as a security boundary (e.g., multi-tenant template systems) are exposed to information disclosure of sensitive prototype properties such as API keys and tokens. This vulnerability is fixed in 10.25.4.

Affected products

• harttle liquidjs: before 10.25.4 — fixed in 10.25.4

How to fix

Upgrade to a fixed version: harttle liquidjs 10.25.4. Check the vendor advisory for mitigations.

References

• https://github.com/harttle/liquidjs/commit/e743da0020d34e2ee547e1cc1a86b58377ebe1ce
• https://github.com/harttle/liquidjs/pull/869
• https://github.com/harttle/liquidjs/releases/tag/v10.25.4
• https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv
• https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv

Get alerted when CVE-2026-39412 or the next vulnerability affects your stack