Product by Harttle
Liquidjs
18 known vulnerabilities in Liquidjs (Harttle), 0 of them actively exploited (CISA KEV).
Key figures
18
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-45618 | LiquidJS is Vulnerable to Remote Code Execution | 10.0 | |
| High | CVE-2026-61556 | LiquidJS: An infinite loop vulnerability in `strip_html` filter | — | |
| High | CVE-2026-69222 | Harttle Liquidjs: Uncontrolled Resource Consumption | 7.5 | |
| High | CVE-2026-30952 | liquidjs has a path traversal fallback vulnerability | 7.5 | |
| High | CVE-2026-55575 | LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce | — | |
| Medium | CVE-2026-106120 | Harttle Liquidjs: Exposure of Sensitive Information to an Unauthorized Actor | — | |
| High | CVE-2026-45617 | LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex | 7.5 | |
| High | CVE-2026-33287 | LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern | 7.5 | |
| High | CVE-2026-35525 | LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates | 7.5 | |
| High | CVE-2026-39859 | LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read | 7.5 | |
| High | CVE-2026-45357 | LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime) | 7.5 | |
| High | CVE-2026-33285 | LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash | 7.5 | |
| High | CVE-2026-41311 | LiquidJS is vulnerable to Denial of Service via circular block reference in layout | 7.5 | |
| Medium | CVE-2026-44645 | LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body | 6.5 | |
| High | CVE-2026-39412 | Harttle Liquidjs: Exposure of Sensitive Information to an Unauthorized Actor | 5.3 | |
| Medium | CVE-2026-44644 | LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS | 6.1 | |
| Medium | CVE-2026-44646 | Harttle Liquidjs: Protection Mechanism Failure | 5.3 | |
| Medium | CVE-2026-34166 | LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter | 3.7 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 32sans-atrisk-mail,