{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aliquidjsliquidjsnode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"id":"CVE-2026-61556"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["liquidjs (\u003e= 10.26.0, \u003c 10.27.1)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","web-application"],"_cs_type":"advisory","_cs_vendors":["LiquidJS"],"content_html":"\u003cp\u003eLiquidJS versions 10.26.0 through 10.27.0 contain a vulnerability in the \u003ccode\u003estrip_html\u003c/code\u003e filter that leads to an infinite loop, resulting in a denial of service (DoS). The flaw exists in \u003ccode\u003esrc/filters/html.ts\u003c/code\u003e due to improper state management during string parsing. When an input string contains a \u003ccode\u003e\u0026lt;\u003c/code\u003e character that is not followed by a matching \u003ccode\u003e\u0026gt;\u003c/code\u003e (or a corresponding closing tag for script, style, or comment blocks), the loop index \u003ccode\u003ei\u003c/code\u003e fails to increment. Because the loop logic repeatedly encounters the same unclosed \u003ccode\u003e\u0026lt;\u003c/code\u003e at the same index, the process hangs indefinitely. This vulnerability is highly accessible, requiring only a two-character input (e.g., \u0026quot;a\u0026lt;\u0026quot;) to exhaust system resources. Given the prevalence of template engines in web applications, this vulnerability poses a significant risk for server-side resource exhaustion.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a web application or internal service utilizing LiquidJS to render user-supplied input.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious payload containing an unclosed HTML tag structure, such as \u0026quot;a\u0026lt;\u0026quot; or similar variants lacking a closing \u003ccode\u003e\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker submits the malicious input to an application endpoint that triggers the \u003ccode\u003estrip_html\u003c/code\u003e filter processing.\u003c/li\u003e\n\u003cli\u003eThe LiquidJS engine initializes the \u003ccode\u003estrip_html\u003c/code\u003e function with the attacker-controlled input.\u003c/li\u003e\n\u003cli\u003eThe function's \u003ccode\u003ewhile\u003c/code\u003e loop locates the \u003ccode\u003e\u0026lt;\u003c/code\u003e at index 1 but fails to find a matching closing delimiter.\u003c/li\u003e\n\u003cli\u003eThe logic checks \u003ccode\u003eif (i === lt)\u003c/code\u003e, which remains true because \u003ccode\u003ei\u003c/code\u003e never advances, returning the control flow to the start of the loop.\u003c/li\u003e\n\u003cli\u003eThe process consumes CPU cycles continuously in an infinite loop.\u003c/li\u003e\n\u003cli\u003eThe application worker process hangs, leading to a denial of service for that specific thread or process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a complete denial of service for the affected application process. Because the infinite loop is triggered by minimal input (two characters), an attacker can easily overwhelm web servers or template-rendering services, leading to system unavailability and resource exhaustion. This impacts any sector deploying LiquidJS in environments that process untrusted user input through the \u003ccode\u003estrip_html\u003c/code\u003e filter.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003eliquidjs\u003c/code\u003e package to version 10.27.1 or later immediately to include the patch for CVE-2026-61556.\u003c/li\u003e\n\u003cli\u003eAudit applications using \u003ccode\u003estrip_html\u003c/code\u003e to determine if user-controlled input is passed directly to this filter without pre-validation.\u003c/li\u003e\n\u003cli\u003eImplement resource monitoring (CPU usage per worker process) to detect stalled processes indicative of DoS attempts.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-03T18:04:10Z","date_published":"2026-09-03T18:04:10Z","id":"https://feed.craftedsignal.io/briefs/2026-09-liquidjs-infinite-loop/","summary":"An infinite loop vulnerability in the LiquidJS strip_html filter, tracked as CVE-2026-61556, allows attackers to trigger a process-wide denial of service by providing specific malformed HTML strings.","title":"Denial of Service Vulnerability in LiquidJS strip_html Filter","url":"https://feed.craftedsignal.io/briefs/2026-09-liquidjs-infinite-loop/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}