Denial of Service Vulnerability in LiquidJS strip_html Filter

LiquidJS versions 10.26.0 through 10.27.0 contain a vulnerability in the strip_html filter that leads to an infinite loop, resulting in a denial of service (DoS). The flaw exists in src/filters/html.ts due to improper state management during string parsing. When an input string contains a < character that is not followed by a matching > (or a corresponding closing tag for script, style, or comment blocks), the loop index i fails to increment. Because the loop logic repeatedly encounters the same unclosed < at the same index, the process hangs indefinitely. This vulnerability is highly accessible, requiring only a two-character input (e.g., "a<") to exhaust system resources. Given the prevalence of template engines in web applications, this vulnerability poses a significant risk for server-side resource exhaustion.

Attack Chain

1. Attacker identifies a web application or internal service utilizing LiquidJS to render user-supplied input.
2. Attacker crafts a malicious payload containing an unclosed HTML tag structure, such as "a<" or similar variants lacking a closing >.
3. Attacker submits the malicious input to an application endpoint that triggers the strip_html filter processing.
4. The LiquidJS engine initializes the strip_html function with the attacker-controlled input.
5. The function's while loop locates the < at index 1 but fails to find a matching closing delimiter.
6. The logic checks if (i === lt), which remains true because i never advances, returning the control flow to the start of the loop.
7. The process consumes CPU cycles continuously in an infinite loop.
8. The application worker process hangs, leading to a denial of service for that specific thread or process.

Impact

Successful exploitation results in a complete denial of service for the affected application process. Because the infinite loop is triggered by minimal input (two characters), an attacker can easily overwhelm web servers or template-rendering services, leading to system unavailability and resource exhaustion. This impacts any sector deploying LiquidJS in environments that process untrusted user input through the strip_html filter.

Recommendation

1. Upgrade the liquidjs package to version 10.27.1 or later immediately to include the patch for CVE-2026-61556.
2. Audit applications using strip_html to determine if user-controlled input is passed directly to this filter without pre-validation.
3. Implement resource monitoring (CPU usage per worker process) to detect stalled processes indicative of DoS attempts.