LI
Vendor
Liquidjs
9
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-41311 | LI Liquidjs Liquidjs | 6.5 | May 9 | LiquidJS is vulnerable to Denial of Service via circular block reference in layout |
| CVE-2026-39859 | LI Liquidjs Liquidjs | 7.5 | Apr 8 | LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read |
| CVE-2026-39412 | LI Liquidjs Liquidjs | 7.5 | Apr 8 | LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel |
| CVE-2026-35525 | LI Liquidjs Liquidjs | 7.5 | Apr 8 | LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates |
| CVE-2026-34166 | LI Liquidjs Liquidjs | 5.3 | Apr 8 | LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter |
| CVE-2026-33285 | LI Liquidjs Liquidjs | 7.5 | Mar 26 | LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash |
| CVE-2026-33287 | LI Liquidjs Liquidjs | 7.5 | Mar 26 | LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern |
| CVE-2026-30952 | LI Liquidjs Liquidjs | 7.5 | Mar 10 | liquidjs has a path traversal fallback vulnerability |
| CVE-2022-25948 | LI Liquidjs Liquidjs | 5.3 | Dec 22 | The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype |