CVE-2026-45618: falha crítica em harttle liquidjs
LiquidJS is Vulnerable to Remote Code Execution
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 10epss 0.8%
LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
harttle · liquidjsCVEs relacionadas — harttle liquidjs
No mesmo produto, das mais perigosas para as menos.
CVE-2026-69222HIGHLiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the processEPSS 0.6%CVE-2026-30952HIGHliquidjs has a path traversal fallback vulnerabilityEPSS 0.6%CVE-2026-61556HIGHLiquidJS: An infinite loop vulnerability in `strip_html` filterEPSS 0.5%CVE-2026-34166LOWLiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` FilterEPSS 0.5%CVE-2026-55575HIGHLiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforceEPSS 0.5%CVE-2026-33287HIGHLiquidJS has Exponential Memory Amplification through its replace_first Filter $& PatternEPSS 0.5%