LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-106120 · Microsoft / collected KEV context

EUVD-2026-93772

GHSA-fwxr-j5w2-587m

cve-program · CVE-2026-106120

• https://github.com/harttle/liquidjs/security/advisories/GHSA-fwxr-j5w2-587m
• https://github.com/harttle/liquidjs/pull/924
• https://github.com/harttle/liquidjs/commit/552819a84b80c62306fe61072628a756272dc749
• https://github.com/harttle/liquidjs/releases/tag/v10.27.2

euvd · EUVD-2026-93772

• https://github.com/harttle/liquidjs/security/advisories/GHSA-fwxr-j5w2-587m
• https://github.com/harttle/liquidjs/pull/924
• https://github.com/harttle/liquidjs/commit/552819a84b80c62306fe61072628a756272dc749
• https://github.com/harttle/liquidjs/releases/tag/v10.27.2

nvd · CVE-2026-106120

• https://github.com/harttle/liquidjs/commit/552819a84b80c62306fe61072628a756272dc749
• https://github.com/harttle/liquidjs/pull/924
• https://github.com/harttle/liquidjs/releases/tag/v10.27.2
• https://github.com/harttle/liquidjs/security/advisories/GHSA-fwxr-j5w2-587m

osv · GHSA-fwxr-j5w2-587m

• https://github.com/harttle/liquidjs/security/advisories/GHSA-fwxr-j5w2-587m
• https://nvd.nist.gov/vuln/detail/CVE-2026-106120
• https://github.com/harttle/liquidjs/pull/924
• https://github.com/harttle/liquidjs/commit/552819a84b80c62306fe61072628a756272dc749
• https://github.com/harttle/liquidjs
• https://github.com/harttle/liquidjs/releases/tag/v10.27.2

No related operational record is retained in the current change model.