Attack Chain

1. Attacker identifies a web application or internal service utilizing LiquidJS to render user-supplied input.
2. Attacker crafts a malicious payload containing an unclosed HTML tag structure, such as "a<" or similar variants lacking a closing >.
3. Attacker submits the malicious input to an application endpoint that triggers the strip_html filter processing.
4. The LiquidJS engine initializes the strip_html function with the attacker-controlled input.
5. The function's while loop locates the < at index 1 but fails to find a matching closing delimiter.
6. The logic checks if (i === lt), which remains true because i never advances, returning the control flow to the start of the loop.
7. The process consumes CPU cycles continuously in an infinite loop.
8. The application worker process hangs, leading to a denial of service for that specific thread or process.

Impact

Successful exploitation results in a complete denial of service for the affected application process. Because the infinite loop is triggered by minimal input (two characters), an attacker can easily overwhelm web servers or template-rendering services, leading to system unavailability and resource exhaustion. This impacts any sector deploying LiquidJS in environments that process untrusted user input through the strip_html filter.

Recommendation

1. Upgrade the liquidjs package to version 10.27.1 or later immediately to include the patch for CVE-2026-61556.
2. Audit applications using strip_html to determine if user-controlled input is passed directly to this filter without pre-validation.
3. Implement resource monitoring (CPU usage per worker process) to detect stalled processes indicative of DoS attempts.