{"id":"EUVD-2026-42354","enisaUuid":"493be169-1c0c-3311-bb1e-3a3c22b24f11","description":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filter at src/filters/array.ts allocated a full clone of its input array via [...toArray(v)] without calling this.context.memoryLimit.use(...), allowing a template render such as {{ huge_array | pop }} to allocate an O(N) clone of an attacker-influenced array outside the configured memoryLimit budget. This issue is fixed in version 10.27.1.","datePublished":"Jul 8, 2026, 7:32:01 PM","dateUpdated":"Jul 9, 2026, 2:00:04 PM","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-g357-x5c3-c72p\nhttps://github.com/harttle/liquidjs/pull/907\nhttps://github.com/harttle/liquidjs/commit/8a0c74a7fcb1671aa1dcb71ec82ba0602dc90d04\nhttps://github.com/harttle/liquidjs/releases/tag/v10.27.1\n","aliases":"CVE-2026-55575\nGHSA-g357-x5c3-c72p\n","assigner":"GitHub_M","epss":0.49,"enisaIdProduct":[{"id":"e7107945-ccb5-35a2-8af7-d11f3fbfc015","product":{"name":"liquidjs","vendor":{"name":"harttle"}},"product_version":"\u003c 10.27.1"}],"enisaIdVendor":[{"id":"3f872681-9830-3c35-902b-552462e5e4ea","vendor":{"name":"harttle"}}],"enisaIdVulnerability":[{"id":"63cac6a7-ffaa-36ad-8ce6-4d42a7b24a5f","vulnerability":{"id":"CVE-2026-55575","description":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filter at src/filters/array.ts allocated a full clone of its input array via [...toArray(v)] without calling this.context.memoryLimit.use(...), allowing a template render such as {{ huge_array | pop }} to allocate an O(N) clone of an attacker-influenced array outside the configured memoryLimit budget. This issue is fixed in version 10.27.1.","datePublished":"Jul 8, 2026, 7:32:01 PM","dateUpdated":"Jul 9, 2026, 2:00:04 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-g357-x5c3-c72p\nhttps://github.com/harttle/liquidjs/pull/907\nhttps://github.com/harttle/liquidjs/commit/8a0c74a7fcb1671aa1dcb71ec82ba0602dc90d04\nhttps://github.com/harttle/liquidjs/releases/tag/v10.27.1\n","enisa_id":"EUVD-2026-42354\n","assigner":"GitHub_M","epss":0.49,"dataProcessed":"Nov 1, 2026, 7:17:06 AM","vulnerabilityProduct":[{"id":"829abd21-f45b-339e-a975-214da85f6c44","product":{"name":"liquidjs","vendor":{"name":"harttle"}},"product_version":"\u003c 10.27.1"}],"vulnerabilityVendor":[{"id":"ebed07b1-522d-33e6-9e32-3504ea466fd0","vendor":{"name":"harttle"}}]}},{"id":"ac19859e-4d4d-3207-93f8-f36b1f328413","vulnerability":{"id":"GHSA-g357-x5c3-c72p","description":"LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce","datePublished":"Jul 24, 2026, 2:05:20 PM","dateUpdated":"Jul 24, 2026, 2:05:20 PM","baseScore":0.0,"references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-g357-x5c3-c72p\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-55575\nhttps://github.com/harttle/liquidjs/pull/907\nhttps://github.com/harttle/liquidjs/commit/8a0c74a7fcb1671aa1dcb71ec82ba0602dc90d04\nhttps://github.com/harttle/liquidjs\nhttps://github.com/harttle/liquidjs/releases/tag/v10.27.1\n","enisa_id":"EUVD-2026-42354\n","aliases":"GHSA-g357-x5c3-c72p\nCVE-2026-55575\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}