LI
Product
liquidjs
18
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 1High 11Medium 6Low 0
Watch
Add liquidjs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44645 | 6.5 | Jun 17 | LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body Affected: < 10.26.0 |
| CVE-2026-41311 | 6.5 | May 9 | LiquidJS is vulnerable to Denial of Service via circular block reference in layout Affected: < 10.25.7 |
| CVE-2026-44644 | 6.1 | Jun 17 | LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS Affected: < 10.26.0 |
| CVE-2026-106120 | 6.0 | Oct 6 | LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration Affected: < 10.27.2 |
| CVE-2026-44646 | 5.3 | Jun 17 | LiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()` Affected: < 10.26.0 |
| CVE-2026-34166 | 5.3 | Apr 8 | LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter Affected: < 10.25.3 |
Showing 6