Description
It is possible to execute arbitrary code with crafted templates
Recommendation
Update the liquidjs package to the latest compatible version. Followings are version details:
- Affected version(s): < 10.26.0
- Patched version(s): 10.26.0
References
Related Issues
- ejs is vulnerable to remote code execution due to weak input validation - CVE-2017-1000228
- angular-base64-upload vulnerable to unauthenticated remote code execution - CVE-2024-42640
- Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal - CVE-2024-47169
- Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified - CVE-2026-69255
You might also like:
- Tags:
- npm
- liquidjs
Anything's wrong? Let us know Last updated on May 27, 2026