Description
liquidjs 10.25.0 documents root as constraining filenames passed to renderFile() and parseFile(), but top-level file loads do not enforce that boundary.
The published npm package [email protected] on Linux 6.17.0 with Node v22.22.1.
Recommendation
Update the liquidjs package to the latest compatible version. Followings are version details:
- Affected version(s): <= 10.25.4
- Patched version(s): 10.25.5
References
Could your website be exposed too?
SmartScanner can check your website for LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @babel/core: Arbitrary File Read via sourceMappingURL Comment - CVE-2026-49356
- Prompty: Arbitrary file read via file reference expansion - CVE-2026-53598
- LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates - CVE-2026-35525
- SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user - CVE-2026-34524
You might also like:
See something that needs correcting? Let us knowUpdated April 09, 2026