CVE-2026-30952

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30952", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T17:34:39.980Z", "datePublished": "2026-03-10T20:25:20.176Z", "dateUpdated": "2026-03-11T14:39:22.286Z"}, "containers": {"cna": {"title": "liquidjs has a path traversal fallback vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x"}, {"name": "https://github.com/harttle/liquidjs/pull/851", "tags": ["x_refsource_MISC"], "url": "https://github.com/harttle/liquidjs/pull/851"}, {"name": "https://github.com/harttle/liquidjs/pull/855", "tags": ["x_refsource_MISC"], "url": "https://github.com/harttle/liquidjs/pull/855"}, {"name": "https://github.com/harttle/liquidjs/commit/3cd024d652dc883c46307581e979fe32302adbac", "tags": ["x_refsource_MISC"], "url": "https://github.com/harttle/liquidjs/commit/3cd024d652dc883c46307581e979fe32302adbac"}], "affected": [{"vendor": "harttle", "product": "liquidjs", "versions": [{"version": "< 10.25.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T20:25:20.176Z"}, "descriptions": [{"lang": "en", "value": "liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0."}], "source": {"advisory": "GHSA-wmfp-5q7x-987x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T14:39:07.165212Z", "id": "CVE-2026-30952", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:39:22.286Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "liquidjs has a path traversal fallback vulnerability", "source": {"advisory": "GHSA-wmfp-5q7x-987x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "harttle", "product": "liquidjs", "versions": [{"status": "affected", "version": "< 10.25.0"}]}], "references": [{"url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x", "name": "https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/harttle/liquidjs/pull/851", "name": "https://github.com/harttle/liquidjs/pull/851", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/harttle/liquidjs/pull/855", "name": "https://github.com/harttle/liquidjs/pull/855", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/harttle/liquidjs/commit/3cd024d652dc883c46307581e979fe32302adbac", "name": "https://github.com/harttle/liquidjs/commit/3cd024d652dc883c46307581e979fe32302adbac", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T20:25:20.176Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30952", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T14:39:07.165212Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-11T14:39:13.623Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-30952", "state": "PUBLISHED", "dateUpdated": "2026-03-10T20:25:20.176Z", "dateReserved": "2026-03-07T17:34:39.980Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T20:25:20.176Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "liquidjs", "vendor": "harttle", "versions": [{"status": "affected", "version": "< 10.25.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "7C54ABF9-1200-4609-BCB2-92D48A591012", "versionEndExcluding": "10.25.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0."}, {"lang": "es", "value": "liquidjs es un motor de plantillas compatible con Shopify / GitHub Pages en JavaScript puro. Antes de la versi\u00f3n 10.25.0, las etiquetas layout, render e include permiten el acceso arbitrario a archivos a trav\u00e9s de rutas absolutas (ya sea como literales de cadena o a trav\u00e9s de variables Liquid; estas \u00faltimas requieren dynamicPartials: true, que es el valor predeterminado). Esto plantea un riesgo de seguridad cuando se permite a usuarios malintencionados controlar el contenido de la plantilla o especificar la ruta del archivo a incluir como una variable Liquid. Esta vulnerabilidad se corrige en la versi\u00f3n 10.25.0."}], "id": "CVE-2026-30952", "lastModified": "2026-06-17T10:33:12.823", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30952", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T14:39:07.165212Z", "version": "2.0.3"}}]}, "published": "2026-03-10T21:16:48.187", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/harttle/liquidjs/commit/3cd024d652dc883c46307581e979fe32302adbac"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/harttle/liquidjs/pull/851"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/harttle/liquidjs/pull/855"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.25.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "liquidjs", "source": "cna", "vendor": "harttle"}, "product": "liquidjs", "vendor": "harttle"}], "analysis": {"en": {"generated_at": "2026-04-17T11:36:56.226414+00:00", "value": {"mitigation_remediation": ["Upgrade to Liquidjs version 10.25.0 or later, which removes absolute path access via the affected tags.", "Set the Liquidjs configuration option `dynamicPartials` to false to prevent variable-driven file inclusion.", "Validate all template paths against a whitelist of allowed directories before rendering to ensure only trusted files are accessed."], "summary": {"action": "Update Package", "impact": "Arbitrary File Read"}, "threat_synthesis": {"affected_systems": "The flaw affects installations of harttle\u2019s Liquidjs package before version 10.25.0 when executed in a Node.js environment. Any Node.js application that incorporates older versions of Liquidjs and renders templates supplied by untrusted users or external entities is at risk.", "description_and_impact": "Liquidjs, a JavaScript template engine used by Shopify and GitHub Pages, contains a path traversal flaw when its layout, render, or include tags are used with absolute paths. The vulnerability allows an attacker that can influence the template content or supply the path as a variable to read any file accessible to the running process. This flaw is classified as a CWE\u201122 Path Traversal and is reflected in the CVSS score of 8.7, indicating high impact on confidentiality.", "risk_and_exploitability": "The risk is high due to the CVSS score, yet the EPSS score of less than 1% suggests that exploitation is currently low probability. Based on the description, it is inferred that the vulnerability does not require elevated privileges or network addressability beyond application exposure, and it is not listed in CISA\u2019s KEV catalog. Attackers would typically supply malicious template code or set the include path variable to access sensitive files, making the threat most likely for web applications that permit user\u2011generated template content."}}}}, "created": "2026-03-11T11:42:50.537557+00:00", "updated": "2026-04-17T11:45:06.229711+00:00", "vendors": ["harttle", "harttle$PRODUCT$liquidjs"]}