Description
The current implementation of strip_html can cause an infinite loop when the input string contains <, has at least one character before <, and no > appears after <.
Recommendation
Update the liquidjs package to the latest compatible version. Followings are version details:
- Affected version(s): >= 10.26.0, < 10.27.1
- Patched version(s): 10.27.1
References
Could your website be exposed too?
SmartScanner can check your website for LiquidJS has an infinite loop vulnerability in its `strip_html` filter and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern - CVE-2026-33287
- LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS - CVE-2026-44644
- LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex - CVE-2026-45617
- LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) - CVE-2026-45357
You might also like:
See something that needs correcting? Let us knowUpdated September 03, 2026