{"id":"EUVD-2026-37827","enisaUuid":"a27625e5-4ecb-388f-a353-e00a2afb11d3","description":"LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter\u0027s strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context\u0027s memoryLimit or renderLimit, so a single small template ({{ x | date: \u0027%5000000d\u0027 }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src/liquid-options.ts:87-92) advertise as DoS controls — and which the docstring explicitly mentions for strftime — are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0.","datePublished":"Jun 17, 2026, 10:32:20 PM","dateUpdated":"Jun 18, 2026, 12:49:15 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q\nhttps://github.com/harttle/liquidjs/commit/3129d46dc95efa357b00e5a57ee1af80a13d72ed\nhttps://github.com/harttle/liquidjs/releases/tag/v10.26.0\n","aliases":"CVE-2026-45357\nGHSA-hh27-hf48-9f5q\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"9e22504e-a115-333e-9ab7-7f7a883ce45b","product":{"name":"liquidjs","vendor":{"name":"harttle"}},"product_version":"\u003c 10.26.0"}],"enisaIdVendor":[{"id":"85d411f6-0fba-3ba0-afef-553bfee869ce","vendor":{"name":"harttle"}}],"enisaIdVulnerability":[{"id":"0aab77df-243c-3f00-bbbb-cf0458c0fb46","vulnerability":{"id":"CVE-2026-45357","description":"LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter\u0027s strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context\u0027s memoryLimit or renderLimit, so a single small template ({{ x | date: \u0027%5000000d\u0027 }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src/liquid-options.ts:87-92) advertise as DoS controls — and which the docstring explicitly mentions for strftime — are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0.","datePublished":"Jun 17, 2026, 10:32:20 PM","dateUpdated":"Jun 18, 2026, 12:49:15 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q\nhttps://github.com/harttle/liquidjs/commit/3129d46dc95efa357b00e5a57ee1af80a13d72ed\nhttps://github.com/harttle/liquidjs/releases/tag/v10.26.0\n","enisa_id":"EUVD-2026-37827\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Oct 28, 2026, 7:17:09 AM","vulnerabilityProduct":[{"id":"dd9c1854-217e-3f09-bcf5-3d9db680e198","product":{"name":"liquidjs","vendor":{"name":"harttle"}},"product_version":"\u003c 10.26.0"}],"vulnerabilityVendor":[{"id":"9fa512f7-6f9c-3605-967f-4d6c017b8651","vendor":{"name":"harttle"}}]}},{"id":"eaf35c39-e9de-3fdd-99fa-52405ed7f414","vulnerability":{"id":"GHSA-hh27-hf48-9f5q","description":"LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)","datePublished":"May 27, 2026, 5:33:52 PM","dateUpdated":"Jul 9, 2026, 9:06:30 PM","baseScore":0.0,"references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45357\nhttps://github.com/harttle/liquidjs/commit/3129d46dc95efa357b00e5a57ee1af80a13d72ed\nhttps://github.com/harttle/liquidjs\nhttps://github.com/harttle/liquidjs/releases/tag/v10.26.0\n","enisa_id":"EUVD-2026-37827\n","aliases":"CVE-2026-45357\nGHSA-hh27-hf48-9f5q\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:56:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}