Skip to content
Threat Feed
Subscribe

Vendor

LiquidJS

3 briefs RSS
medium advisory

Denial of Service Vulnerability in LiquidJS strip_html Filter

An infinite loop vulnerability in the LiquidJS strip_html filter, tracked as CVE-2026-61556, allows attackers to trigger a process-wide denial of service by providing specific malformed HTML strings.

liquidjs +1 denial-of-service vulnerability web-application
1t 1c updated
high advisory

LiquidJS Template Engine Root Restriction Bypass via Symlink Exploitation

A vulnerability in LiquidJS allows attackers to bypass template root restrictions by using symlinks within allowed directories to render arbitrary files outside the intended scope, potentially leading to sensitive information disclosure.

LiquidJS Template Engine liquidjs symlink template-injection root-restriction-bypass
2r 2t
high advisory

LiquidJS Memory Limit Bypass Leads to Denial of Service

A vulnerability in LiquidJS versions 10.24.0 and earlier allows a threat actor with control over template content to bypass the `memoryLimit` protection mechanism, leading to a denial of service by using reverse range expressions to allocate unlimited memory and a string flattening operation to cause a V8 Fatal error that crashes the Node.js process.

LiquidJS denial-of-service template-injection nodejs
2r 2t