LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-55575 · Microsoft / collected KEV context

EUVD-2026-42354

GHSA-g357-x5c3-c72p

cve-program · CVE-2026-55575

• https://github.com/harttle/liquidjs/security/advisories/GHSA-g357-x5c3-c72p
• https://github.com/harttle/liquidjs/pull/907
• https://github.com/harttle/liquidjs/commit/8a0c74a7fcb1671aa1dcb71ec82ba0602dc90d04
• https://github.com/harttle/liquidjs/releases/tag/v10.27.1

euvd · EUVD-2026-42354

• https://github.com/harttle/liquidjs/security/advisories/GHSA-g357-x5c3-c72p
• https://github.com/harttle/liquidjs/pull/907
• https://github.com/harttle/liquidjs/commit/8a0c74a7fcb1671aa1dcb71ec82ba0602dc90d04
• https://github.com/harttle/liquidjs/releases/tag/v10.27.1

nvd · CVE-2026-55575

• https://github.com/harttle/liquidjs/commit/8a0c74a7fcb1671aa1dcb71ec82ba0602dc90d04
• https://github.com/harttle/liquidjs/pull/907
• https://github.com/harttle/liquidjs/releases/tag/v10.27.1
• https://github.com/harttle/liquidjs/security/advisories/GHSA-g357-x5c3-c72p

osv · GHSA-g357-x5c3-c72p

• https://github.com/harttle/liquidjs/security/advisories/GHSA-g357-x5c3-c72p
• https://nvd.nist.gov/vuln/detail/CVE-2026-55575
• https://github.com/harttle/liquidjs/pull/907
• https://github.com/harttle/liquidjs/commit/8a0c74a7fcb1671aa1dcb71ec82ba0602dc90d04
• https://github.com/harttle/liquidjs
• https://github.com/harttle/liquidjs/releases/tag/v10.27.1

No related operational record is retained in the current change model.