LiquidJS is Vulnerable to Remote Code Execution

LiquidJS: An infinite loop vulnerability in `strip_html` filter

LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime)

LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex

LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read

LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel

LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates

LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash

LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern

liquidjs has a path traversal fallback vulnerability

LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

LiquidJS is vulnerable to Denial of Service via circular block reference in layout

LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS

LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

LiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`

LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter