Vulnerability · Published Aug 19, 2026 · Assigned by GitHub_M

CVE-2026-61556LiquidJS: An infinite loop vulnerability in `strip_html` filter

High 8.7

In plain English

A high-severity infinite loop in liquidjs from harttle. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 55.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In strip_html, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a<. This issue is fixed in version 10.27.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	liquidjs	10.27.1	GHSA-m7fp-h3p4-hr49

Affected products (as reported)

Vendor	Product	Versions
harttle	liquidjs	>= 10.26.0, < 10.27.1

Weakness: CWE-835 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/harttle/liquidjs/security/advisories/GHSA-m7fp-h3p4-hr49 x_refsource_CONFIRM
https://github.com/harttle/liquidjs/pull/917 x_refsource_MISC
https://github.com/harttle/liquidjs/commit/5c3522f33928aae66f0fe85c36e1d9015c768fe2 x_refsource_MISC
https://github.com/harttle/liquidjs/releases/tag/v10.27.1 x_refsource_MISC