{"id":"EUVD-2026-56922","revision":"739b83bb5fdf48c49a9e6d4540740ecd","records":[{"revision":"739b83bb5fdf48c49a9e6d4540740ecd","observedAt":"2026-11-07T10:35:12.382+00:00","statement":{"source":"euvd","id":"EUVD-2026-56922","aliases":["CVE-2026-45618","GHSA-gf2q-c269-pqgc"],"title":"LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.","description":"LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":10,"severity":null}],"references":["https://github.com/harttle/liquidjs/security/advisories/GHSA-gf2q-c269-pqgc","https://github.com/harttle/liquidjs/releases/tag/v10.26.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56922","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 11, 2026, 7:27:09 PM","dateUpdated":"Aug 13, 2026, 2:07:35 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-56922","identifiers":["EUVD-2026-56922","CVE-2026-45618","GHSA-gf2q-c269-pqgc"]},"retained":false,"historicalAffected":[]}],"coverage":[]}