npm

liquidjs

18 Total advisories

18 Vulnerabilities

0 Malware

Dependency scanning

Check whether liquidjs is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

liquidjs

Vulnerabilities

LiquidJS is Vulnerable to Remote Code Execution

LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS

LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel

LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter

LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex

LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)

LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`

LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read

LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates

liquidjs has a Denial of Service via circular block reference in layout

liquidjs has a path traversal fallback vulnerability

LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

LiquidJS has an infinite loop vulnerability in its `strip_html` filter

LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash

LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern

liquidjs may leak properties of a prototype

Browse more npm advisories

Start Securing