CVE-2026-45357
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk30th percentile — higher than 30% of all known CVEs
Summary
In versions 10.25.7 and below of the LiquidJS template engine, a vulnerability exists related to the date filter that improperly processes width specifiers, leading to unbounded string concatenation and bypassing memory and render limits.
Risk Assessment
Exploitation of this vulnerability can lead to large memory allocations, high CPU usage, or OOM crashes during rendering, potentially affecting service availability.
Recommendation
It is recommended to upgrade to version 10.26.0 or later to mitigate this vulnerability and restore control over memory and render limits.
Original NVD description (English source)
LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, so a single small template ({{ x | date: '%5000000d' }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src/liquid-options.ts:87-92) advertise as DoS controls — and which the docstring explicitly mentions for strftime — are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0.