CVE-2026-61556: fallo de gravedad alta en harttle liquidjs
LiquidJS: An infinite loop vulnerability in `strip_html` filter
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.5%
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In strip_html, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a<. This issue is fixed in version 10.27.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
harttle · liquidjsCVEs relacionadas — harttle liquidjs
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-45618CRITICALLiquidJS is Vulnerable to Remote Code ExecutionEPSS 0.8%CVE-2026-69222HIGHLiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the processEPSS 0.6%CVE-2026-30952HIGHliquidjs has a path traversal fallback vulnerabilityEPSS 0.6%CVE-2026-34166LOWLiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` FilterEPSS 0.5%CVE-2026-55575HIGHLiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforceEPSS 0.5%CVE-2026-33287HIGHLiquidJS has Exponential Memory Amplification through its replace_first Filter $& PatternEPSS 0.5%