LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.
Critical CVSS 10.0
Summary
LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/harttle/liquidjs/releases/tag/v10.26.0
- https://github.com/harttle/liquidjs/security/advisories/GHSA-gf2q-c269-pqgc
- https://github.com/harttle/liquidjs/security/advisories/GHSA-gf2q-c269-pqgc
Timeline
- nvd_ingest NVD