CVE-2026-39412

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.4, the sort_natural filter bypasses the ownPropertyOnly security option, allowing template authors to extract values of prototype-inherited properties through a sorting side-channel attack. Applications relying on ownPropertyOnly: true as a security boundary (e.g., multi-tenant template systems) are exposed to information disclosure of sensitive prototype properties such as API keys and tokens. This vulnerability is fixed in 10.25.4.

• CWE-200

• https://github.com/harttle/liquidjs/commit/e743da0020d34e2ee547e1cc1a86b58377ebe1cePatch
• https://github.com/harttle/liquidjs/pull/869Issue Tracking, Product
• https://github.com/harttle/liquidjs/releases/tag/v10.25.4Release Notes
• https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvvExploit, Vendor Advisory
• https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvvExploit, Vendor Advisory

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39407Hono is a Web application framework that provides support fo…5.3
• CVE-2026-39408Hono is a Web application framework that provides support fo…7.5
• CVE-2026-39409Hono is a Web application framework that provides support fo…5.3
• CVE-2026-3941Insufficient policy enforcement in DevTools in Google Chrome…4.3
• CVE-2026-39410Hono is a Web application framework that provides support fo…4.8
• CVE-2026-39411LobeHub is a work-and-lifestyle space to find, build, and co…7.1
• CVE-2026-39413LightRAG provides simple and fast retrieval-augmented genera…6.5
• CVE-2026-39414MinIO is a high-performance object storage system. From RELE…6.5
• CVE-2026-39415Frappe Learning Management System (LMS) is a learning system…4.3
• CVE-2026-39416AIL framework is an open-source platform to collect, crawl, …6.1
• CVE-2026-39417MaxKB is an open-source AI assistant for enterprise. Version…5.5
• CVE-2026-39418MaxKB is an open-source AI assistant for enterprise. In vers…7.4