Description
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling) — sibling class of GHSA-8xx9-69p8-7jp3 and GHSA-2546-xv4c-mc8g, applied to memoryLimit instead of renderLimit
Recommendation
Update the liquidjs package to the latest compatible version. Followings are version details:
- Affected version(s): <= 10.27.0
- Patched version(s): 10.27.1
References
Could your website be exposed too?
SmartScanner can check your website for LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern - CVE-2026-33287
- LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
- Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
- LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()` - CVE-2026-44646
You might also like:
See something that needs correcting? Let us knowUpdated July 24, 2026