CVE-2026-45618
CriticalSummary
A vulnerability in the Liquid library allows arbitrary code execution via crafted templates. The issue stems from accessing the `this` object through the `valueOf` filter.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary code on the server, leading to full application compromise and potential data breach.
Recommendation
Immediately update the Liquid library to the latest patched version. Additionally, restrict the ability to submit custom templates from untrusted users.
Original NVD description (English source)
### Summary It is possible to execute arbitrary code with crafted templates ### Details <details> <summary> `1|valueOf` -> `this` when evaluating the filter </summary> ```liquid {%assign r=1|valueOf%} {{r|inspect}} ``` ```json {"context":{"scopes":[{"r":"[Circular]"}],"registers":{},"breakCa