LiquidJS: An infinite loop vulnerability in `strip_html` filter

LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime)

LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex

LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read

LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel

LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates

LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash

LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern

liquidjs has a path traversal fallback vulnerability