LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`

Description

Context.spawn() in liquidjs creates a child Context for the {% render %} tag but does not propagate the parent context’s resolved ownPropertyOnly value. The new context re-derives ownPropertyOnly from opts.ownPropertyOnly (the instance-level option), silently discarding any RenderOptions.ownPropertyOnly override that was supplied to parseAndRender().

Recommendation

No fix is available yet. Followings are affected versions:

• <= 10.25.7

References

• GHSA-9x9p-qf8f-mvjg
• CVE-2026-44646
• CWE-693
• CAPEC-310
• OWASP 2021-A6

Related Issues

• ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context - CVE-2026-33889
• LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) - CVE-2026-45357
• LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting sid - CVE-2026-39412
• liquidjs has a Denial of Service via circular block reference in layout - CVE-2026-41311

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

liquidjs