CVE-2026-45357

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, so a single small template ({{ x | date: '%5000000d' }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src/liquid-options.ts:87-92) advertise as DoS controls — and which the docstring explicitly mentions for strftime — are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0.

• CWE-400

• https://github.com/harttle/liquidjs/commit/3129d46dc95efa357b00e5a57ee1af80a13d72ed
• https://github.com/harttle/liquidjs/releases/tag/v10.26.0
• https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q
• https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q

Published

Jun 17, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45349Open WebUI is a self-hosted artificial intelligence platform…7.1
• CVE-2026-4535A vulnerability has been found in Tenda FH451 1.0.0.9. This …8.8
• CVE-2026-45350Open WebUI is a self-hosted artificial intelligence platform…7.1
• CVE-2026-45351Open WebUI is a self-hosted artificial intelligence platform…6.5
• CVE-2026-45352cpp-httplib is a C++11 single-file header-only cross platfor…7.5
• CVE-2026-45353electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…7.8
• CVE-2026-45358ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-45359ImageMagick is free and open-source software used for editin…5.7
• CVE-2026-4536A vulnerability was found in Acrel Environmental Monitoring …7.3
• CVE-2026-45360Apache Airflow's scheduler-side deadline-reference decoder (…7.3
• CVE-2026-45361Apache Airflow providers-google's `ComputeEngineSSHHook` dis…8.1
• CVE-2026-45362Sangoma Switchvox before 8.4 places cleartext SIP authentica…3.2