Medium
CVE-2026-106120
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 19
Reset filters
High
CVE-2026-69222
LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
High
CVE-2026-61556
LiquidJS has an infinite loop vulnerability in its `strip_html` filter
High
CVE-2026-55575
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
Critical
CVE-2026-45618
LiquidJS is Vulnerable to Remote Code Execution
High
CVE-2026-45617
LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex
High
CVE-2026-45357
LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)
Medium
CVE-2026-44646
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
Medium
CVE-2026-44645
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
Medium
CVE-2026-44644
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
High
CVE-2026-41311
liquidjs has a Denial of Service via circular block reference in layout
Medium
CVE-2026-39859
LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read
Medium
CVE-2026-39412
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
High
CVE-2026-35525
LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates
Low
CVE-2026-34166
LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter
High
CVE-2026-33287
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
High
CVE-2026-33285
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
High
CVE-2026-30952
liquidjs has a path traversal fallback vulnerability
Medium
CVE-2022-25948
liquidjs may leak properties of a prototype
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.