Hharttle

Products

Exploited and recent CVEs

• CVE-2026-106120 Medium 6.0 LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration 0.4%
• CVE-2026-69222 High 7.5 LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process 0.6%
• CVE-2026-61556 High 8.7 LiquidJS: An infinite loop vulnerability in `strip_html` filter 0.5%
• CVE-2026-45618 Critical 10.0 LiquidJS is Vulnerable to Remote Code Execution 0.8%
• CVE-2026-55575 High 8.2 LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce 0.5%
• CVE-2026-45357 High 7.5 LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime) 0.4%
• CVE-2026-44646 Medium 5.3 LiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()` 0.3%
• CVE-2026-45617 High 7.5 LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex 0.5%
• CVE-2026-44645 Medium 6.5 LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body 0.4%
• CVE-2026-44644 Medium 6.1 LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS 0.2%
• CVE-2026-41311 High 7.5 LiquidJS is vulnerable to Denial of Service via circular block reference in layout 0.4%
• CVE-2026-39859 High 7.5 LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read 0.5%
• CVE-2026-39412 Medium 5.3 LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel 0.4%
• CVE-2026-35525 High 8.2 LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates 0.4%
• CVE-2026-34166 Low 3.7 LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter 0.5%
• CVE-2026-33285 High 7.5 LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash 0.4%
• CVE-2026-33287 High 7.5 LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern 0.5%
• CVE-2026-30952 High 8.7 liquidjs has a path traversal fallback vulnerability 0.6%