What’s Vulnerable › Vulnerabilities
CVE-2026-45017: Python Liquid: Absolute paths escape filesystem loader search path
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-28 · updated 2026-10-26
- Weakness: CWE-22
Description
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0.
Affected products
- jg-rp liquid: before 2.2.0 — fixed in 2.2.0
How to fix
Upgrade to a fixed version: jg-rp liquid 2.2.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-45017 or the next vulnerability affects your stack