Description
Context.spawn() in liquidjs creates a child Context for the {% render %} tag but does not propagate the parent context’s resolved ownPropertyOnly value. The new context re-derives ownPropertyOnly from opts.ownPropertyOnly (the instance-level option), silently discarding any RenderOptions.ownPropertyOnly override that was supplied to parseAndRender().
Recommendation
No fix is available yet. Followings are affected versions:
- <= 10.25.7
References
Could your website be exposed too?
SmartScanner can check your website for LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()` and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting sid - CVE-2026-39412
- LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) - CVE-2026-45357
- ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag - CVE-2026-8813
- liquidjs has a Denial of Service via circular block reference in layout - CVE-2026-41311
You might also like:
See something that needs correcting? Let us knowUpdated July 09, 2026