LiquidJS vulnerabilities

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.

LiquidJS prior to 10.27.2 does not consistently enforce ownPropertyOnly for inherited array indices, as negative indexing, .first, .last, first/last filters, join, reverse, slice, compact, and for-loop iteration can read prototype-provided elements outside readJSProperty(). An attacker able to influence prototype state can disclose values that ownPropertyOnly is expected to hide.

In LiquidJS before 10.27.2, the join filter in src/filters/array.ts computes complexity from array length and separator length instead of the total string length. The concat filter can cheaply double arrays, and join then materializes content while charging only for element count, allowing a template to exceed memoryLimit. The array_to_sentence_string filter has a similar defect, potentially crashing the process.

In LiquidJS from 10.26.0 to 10.27.1, the strip_html filter can enter an infinite loop when the input contains '<', has at least one preceding character, and no later '>'. This blocks template rendering and can cause denial of service with input as short as 'a<'.

In LiquidJS prior to version 10.27.1, the 'pop' array filter allocates a full clone of the input array without respecting the memoryLimit budget. This allows a template render like {{ huge_array | pop }} to allocate memory outside the configured limit.

LiquidJS is a Shopify/GitHub Pages compatible template engine that in versions 10.25.7 and below contains a flawed regex in the strip_html filter. This leads to ReDoS attacks via quadratic backtracking, blocking the Node.js event loop.

In versions 10.25.7 and below of the LiquidJS template engine, a vulnerability exists related to the date filter that improperly processes width specifiers, leading to unbounded string concatenation and bypassing memory and render limits.

In versions 10.25.7 and below, the LiquidJS template engine incorrectly propagates the ownPropertyOnly value from the parent context, leading to a silent bypass. As a result, developers may inadvertently expose prototype-chain properties in unsafe renders.

In versions 10.25.7 and below of the LiquidJS template engine, the renderLimit option can be fully bypassed by using an empty {% for %} or {% tablerow %} tag. This allows for unlimited rendering time consumption, potentially leading to DoS attacks.

LiquidJS, a template engine compatible with Shopify/GitHub Pages, has a vulnerability to XSS in versions 10.25.7 and below due to a flaw in the strip_html filter logic. This flaw allows bypassing HTML sanitization, enabling attackers to inject malicious code.

LiquidJS before version 10.25.7 is vulnerable to a DoS attack via circular block references in {% layout %} / {% block %}, causing memory exhaustion and Node.js process crash.

LiquidJS before version 10.25.3 has a vulnerability that allows reading arbitrary files. Although root is set to constrain access, top-level file loads do not enforce that boundary. A Liquid instance configured with an empty temporary directory as root can return the contents of arbitrary files.

Vulnerability in LiquidJS before version 10.25.4, where the sort_natural filter bypasses the ownPropertyOnly security option. This allows template authors to extract values of prototype-inherited properties through a sorting side-channel attack.

LiquidJS before version 10.25.3 has a path restriction bypass vulnerability in {% include %}, {% render %}, and {% layout %} directives. The containment check is path-based, not realpath-based, so a symlink inside the allowed root pointing outside bypasses the restriction.

LiquidJS before version 10.25.3 has a vulnerability in the replace filter that incorrectly accounts for memory usage when the memoryLimit option is enabled. An attacker controlling template content can bypass DoS protection and cause out-of-memory conditions with approximately 2500x amplification.