CVE-2026-35525

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35525", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-03T02:15:39.281Z", "datePublished": "2026-04-08T19:30:24.802Z", "dateUpdated": "2026-04-08T19:53:00.573Z"}, "containers": {"cna": {"title": "LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates", "problemTypes": [{"descriptions": [{"cweId": "CWE-61", "lang": "en", "description": "CWE-61: UNIX Symbolic Link (Symlink) Following", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/harttle/liquidjs/security/advisories/GHSA-56p5-8mhr-2fph", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-56p5-8mhr-2fph"}, {"name": "https://github.com/harttle/liquidjs/pull/867", "tags": ["x_refsource_MISC"], "url": "https://github.com/harttle/liquidjs/pull/867"}, {"name": "https://github.com/harttle/liquidjs/releases/tag/v10.25.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/harttle/liquidjs/releases/tag/v10.25.3"}], "affected": [{"vendor": "harttle", "product": "liquidjs", "versions": [{"version": "< 10.25.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-08T19:30:50.414Z"}, "descriptions": [{"lang": "en", "value": "LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, for {% include %}, {% render %}, and {% layout %}, LiquidJS checks whether the candidate path is inside the configured partials or layouts roots before reading it. That check is path-based, not realpath-based. Because of that, a file like partials/link.liquid passes the directory containment check as long as its pathname is under the allowed root. If link.liquid is actually a symlink to a file outside the allowed root, the filesystem follows the symlink when the file is opened and LiquidJS renders the external target. So the restriction is applied to the path string that was requested, not to the file that is actually read. This matters in environments where an attacker can place templates or otherwise influence files under a trusted template root, including uploaded themes, extracted archives, mounted content, or repository-controlled template trees. This vulnerability is fixed in 10.25.3."}], "source": {"advisory": "GHSA-56p5-8mhr-2fph", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T19:52:53.691880Z", "id": "CVE-2026-35525", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T19:53:00.573Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35525", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T19:52:53.691880Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T19:52:57.329Z"}}], "cna": {"title": "LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates", "source": {"advisory": "GHSA-56p5-8mhr-2fph", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "harttle", "product": "liquidjs", "versions": [{"status": "affected", "version": "< 10.25.3"}]}], "references": [{"url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-56p5-8mhr-2fph", "name": "https://github.com/harttle/liquidjs/security/advisories/GHSA-56p5-8mhr-2fph", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/harttle/liquidjs/pull/867", "name": "https://github.com/harttle/liquidjs/pull/867", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/harttle/liquidjs/releases/tag/v10.25.3", "name": "https://github.com/harttle/liquidjs/releases/tag/v10.25.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, for {% include %}, {% render %}, and {% layout %}, LiquidJS checks whether the candidate path is inside the configured partials or layouts roots before reading it. That check is path-based, not realpath-based. Because of that, a file like partials/link.liquid passes the directory containment check as long as its pathname is under the allowed root. If link.liquid is actually a symlink to a file outside the allowed root, the filesystem follows the symlink when the file is opened and LiquidJS renders the external target. So the restriction is applied to the path string that was requested, not to the file that is actually read. This matters in environments where an attacker can place templates or otherwise influence files under a trusted template root, including uploaded themes, extracted archives, mounted content, or repository-controlled template trees. This vulnerability is fixed in 10.25.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-61", "description": "CWE-61: UNIX Symbolic Link (Symlink) Following"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-08T19:30:50.414Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35525", "state": "PUBLISHED", "dateUpdated": "2026-04-08T19:53:00.573Z", "dateReserved": "2026-04-03T02:15:39.281Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-08T19:30:24.802Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "liquidjs", "vendor": "harttle", "versions": [{"status": "affected", "version": "< 10.25.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "D2AAC345-0EF3-40DC-928F-0A77E0779B5A", "versionEndExcluding": "10.25.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, for {% include %}, {% render %}, and {% layout %}, LiquidJS checks whether the candidate path is inside the configured partials or layouts roots before reading it. That check is path-based, not realpath-based. Because of that, a file like partials/link.liquid passes the directory containment check as long as its pathname is under the allowed root. If link.liquid is actually a symlink to a file outside the allowed root, the filesystem follows the symlink when the file is opened and LiquidJS renders the external target. So the restriction is applied to the path string that was requested, not to the file that is actually read. This matters in environments where an attacker can place templates or otherwise influence files under a trusted template root, including uploaded themes, extracted archives, mounted content, or repository-controlled template trees. This vulnerability is fixed in 10.25.3."}, {"lang": "es", "value": "LiquidJS es un motor de plantillas compatible con Shopify / GitHub Pages en JavaScript puro. Antes de la versi\u00f3n 10.25.3, para {% include %}, {% render %} y {% layout %}, LiquidJS verifica si la ruta candidata est\u00e1 dentro de las ra\u00edces de parciales o dise\u00f1os configuradas antes de leerla. Esa verificaci\u00f3n se basa en la ruta, no en la ruta real. Debido a eso, un archivo como partials/link.liquid pasa la verificaci\u00f3n de contenci\u00f3n de directorio siempre que su nombre de ruta est\u00e9 bajo la ra\u00edz permitida. Si link.liquid es en realidad un enlace simb\u00f3lico a un archivo fuera de la ra\u00edz permitida, el sistema de archivos sigue el enlace simb\u00f3lico cuando se abre el archivo y LiquidJS renderiza el objetivo externo. As\u00ed, la restricci\u00f3n se aplica a la cadena de ruta que fue solicitada, no al archivo que realmente se lee. Esto importa en entornos donde un atacante puede colocar plantillas o influir de otra manera en archivos bajo una ra\u00edz de plantilla de confianza, incluyendo temas subidos, archivos extra\u00eddos, contenido montado o \u00e1rboles de plantillas controlados por repositorio. Esta vulnerabilidad se corrige en la versi\u00f3n 10.25.3."}], "id": "CVE-2026-35525", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35525", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T19:52:53.691880Z", "version": "2.0.3"}}]}, "published": "2026-04-08T20:16:24.913", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/harttle/liquidjs/pull/867"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/harttle/liquidjs/releases/tag/v10.25.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-56p5-8mhr-2fph"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-61"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.25.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "liquidjs", "source": "cna", "vendor": "harttle"}, "product": "liquidjs", "vendor": "harttle"}], "analysis": {"en": {"generated_at": "2026-04-10T22:22:25.290615+00:00", "value": {"mitigation_remediation": ["Update LiquidJS to version 10.25.3 or later to eliminate the path restriction bypass.", "Ensure that directories used for partials and layouts are not writable by untrusted users and that symlinks are not allowed in those directories.", "Review existing templates for unexpected symlinks and remove any that point outside the intended directory."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Products affected are LiquidJS libraries released by harttle. Any installation using a version earlier than 10.25.3 is vulnerable. The issue is documented for all variants of LiquidJS that support include, render, or layout tags, as the root restriction check is universal across them.", "description_and_impact": "This vulnerability occurs when LiquidJS loads partial or layout templates through {% include %}, {% render %}, or {% layout %} tags. The engine checks that the requested path is inside the configured root directories using a string comparison, but it does not resolve the actual filesystem path. Therefore a symlink placed under the partials or layouts root that points to a file outside the allowed directory can be loaded and executed. An attacker who can create or modify a symlink in the trusted template tree can thus have LiquidJS render a malicious template or read sensitive files, which may lead to remote code execution or information disclosure. The flaw is a classic path\u2011traversal/symlink abuse (CWE\u201161).", "risk_and_exploitability": "The CVSS base score for this flaw is 8.2, indicating a high severity. Attackers require the ability to place or modify a symlink within the allowed partials or layout directories, a capability that exists in environments where user input can influence uploaded themes, theme archives, or repository\u2011controlled template trees. The EPSS score is below 1\u202f%, suggesting few exploitable public deployments at present, and the vulnerability is not present in CISA's KEV catalog. Nonetheless, once an attacker can write to the template root, exploitation is straightforward and could achieve code execution under the privileges of the running application. Implementing the fix removes the path containment flaw and eliminates the possibility of executing unintended templates."}}}}, "created": "2026-04-09T08:18:17.086078+00:00", "updated": "2026-04-13T14:25:04.931295+00:00", "vendors": ["harttle", "harttle$PRODUCT$liquidjs"]}