liquidjs vulnerabilities

CVEs whose affected-version data names the liquidjs package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

3 CVEsRSS

CVE-2026-69222High· 7.5

1mo ago

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from array.length and separator length instead of the total string length p…

▾ Twilightliquidjs · liquidjsEPSS 0.37%via NVD

CVE-2026-61556High

1mo ago

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least on…

▾ Twilightliquidjs · liquidjsEPSS 0.39%via NVD

CVE-2026-55575High

2mo ago

LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

▾ Twilightliquidjs · liquidjsEPSS 0.52%via GHSA