LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting sid

Description

The sort_natural filter bypasses the ownPropertyOnly security option, allowing template authors to extract values of prototype-inherited properties through a sorting side-channel attack. Applications relying on ownPropertyOnly: true as a security boundary (e.g.

Recommendation

Update the liquidjs package to the latest compatible version. Followings are version details:

• Affected version(s): <= 10.25.3
• Patched version(s): 10.25.4

References

• GHSA-rv5g-f82m-qrvv
• CVE-2026-39412
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
• LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) - CVE-2026-45357
• LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS - CVE-2026-44644
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - CVE-2026-2950

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Exploiting Server Version Disclosure

Update Cheat Sheet for Developers

Tags:

npm

liquidjs