Description

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-11T20:17:40.163Z",
  "pubdate": "2026-08-11T20:17:40.163Z",
  "executiveSummary": "An arbitrary code execution vulnerability has been identified in LiquidJS, a Shopify and GitHub Pages compatible template engine.\nThe vulnerability allows an attacker capable of supplying or modifying template content to execute arbitrary code within the context of the running application.\nThe affected product is LiquidJS in versions prior to 10.26.0, which introduces the necessary patch to remediate the flaw.\nThe risk implications are severe, as successful exploitation could lead to full system compromise, unauthorized data access, or remote code execution depending on the execution context of the template engine.\nAttacker capabilities require the ability to craft malicious templates processed by the vulnerable template engine instance.\nExploitation requirements depend on the integration context, specifically whether untrusted user input is allowed to define or influence template syntax and structure processed by LiquidJS.",
  "technicalDetails": "The vulnerability resides within the template parsing and evaluation logic of LiquidJS, specifically prior to version 10.26.0.\nThe root cause stems from insufficient sanitization, filtering, or restriction of expressions evaluated during the rendering lifecycle of crafted templates.\nWhen a user supplies a specially crafted template containing malicious syntax, the template engine fails to adequately sandbox the execution environment, permitting access to underlying JavaScript execution contexts or sensitive internal APIs.\nThe attack flow begins when an application passes untrusted user-supplied input to the LiquidJS parsing and rendering functions.\nBy leveraging specific syntax constructs or expression chains within the crafted template, the parser evaluates instructions that break out of the intended template data scope.\nThis payload behavior enables the execution of arbitrary JavaScript code or underlying system commands depending on the host environment configuration.\nThe vulnerable component is the LiquidJS template processing engine.\nNetwork exposure and authentication requirements are contingent on the architecture of the application utilizing LiquidJS; however, if the application exposes an endpoint where users can submit custom templates, remote unauthenticated or authenticated attackers can trigger the flaw.\nPrivilege requirements are low from the perspective of the template engine, as the execution occurs with the privileges of the hosting Node.js process.\nPost-exploitation impact includes unauthorized data exfiltration, modification of application state, denial of service, or complete remote code execution on the server hosting the vulnerable LiquidJS instance."
}