GHSA-9x9p-qf8f-mvjg
Medium · 5.3CVSS
5.3
EPSS
—
Published
May 27, 2026
CISA due date
—
The record
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | liquidjs | 0 | No fix |
Related vulnerabilities
- CVE-2026-44646 LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Same vulnerability
- CVE-2026-45617 LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Also affects liquidjs
- CVE-2026-45357 LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Also affects liquidjs
- CVE-2026-44645 LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Also affects liquidjs
- CVE-2026-44644 LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Also affects liquidjs
- GHSA-gf2q-c269-pqgc LiquidJS is Vulnerable to Remote Code Execution Also affects liquidjs
- GHSA-r7g9-xpmj-5fcq LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex Also affects liquidjs
- GHSA-hh27-hf48-9f5q LiquidJS has a memory and render limit bypass via unbounded width padding in `date`… Also affects liquidjs