CVE-2026-44645

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44645", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T15:30:10.875Z", "datePublished": "2026-06-17T22:08:19.354Z", "dateUpdated": "2026-06-18T19:05:32.418Z"}, "containers": {"cna": {"title": "LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/harttle/liquidjs/security/advisories/GHSA-8xx9-69p8-7jp3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-8xx9-69p8-7jp3"}, {"name": "https://github.com/harttle/liquidjs/commit/5b9c3469085e01c79e2d0af28e2a13f730e1793d", "tags": ["x_refsource_MISC"], "url": "https://github.com/harttle/liquidjs/commit/5b9c3469085e01c79e2d0af28e2a13f730e1793d"}, {"name": "https://github.com/harttle/liquidjs/releases/tag/v10.26.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/harttle/liquidjs/releases/tag/v10.26.0"}], "affected": [{"vendor": "harttle", "product": "liquidjs", "versions": [{"version": "< 10.26.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-17T22:08:19.354Z"}, "descriptions": [{"lang": "en", "value": "LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the renderLimit option can be fully bypassed by a {% for %} (or {% tablerow %}) tag whose body is empty. The renderLimit option is documented in docs/source/tutorials/dos.md as the mechanism that \"mitigates this by limiting the time consumed by each render() call.\" The per-iteration time check is reached only when the body contains at least one template node, so a template such as {%- for i in (1..N) -%}{%- endfor -%} iterates the full collection without ever consulting renderLimit. With a configured renderLimit of 50 ms, a single parseAndRenderSync call has been observed to consume 2.26 seconds (~45\u00d7 over the limit) and scales linearly with N up to memoryLimit, allowing a low-privileged template author to wedge an event-loop thread for an attacker-chosen duration. Deployments that rely on a finite renderLimit for DoS protection (common in multi-tenant template-authoring environments) can still be forced by a single crafted template to monopolize a Node.js event-loop worker for attacker-controlled time, potentially stalling in-flight requests, with availability impact only. This issue has been fixed in version 10.26.0."}], "source": {"advisory": "GHSA-8xx9-69p8-7jp3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-8xx9-69p8-7jp3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-18T19:05:03.703365Z", "id": "CVE-2026-44645", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-18T19:05:32.418Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44645", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-18T19:05:03.703365Z"}}}], "references": [{"url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-8xx9-69p8-7jp3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-18T19:03:50.192Z"}}], "cna": {"title": "LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body", "source": {"advisory": "GHSA-8xx9-69p8-7jp3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "harttle", "product": "liquidjs", "versions": [{"status": "affected", "version": "< 10.26.0"}]}], "references": [{"url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-8xx9-69p8-7jp3", "name": "https://github.com/harttle/liquidjs/security/advisories/GHSA-8xx9-69p8-7jp3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/harttle/liquidjs/commit/5b9c3469085e01c79e2d0af28e2a13f730e1793d", "name": "https://github.com/harttle/liquidjs/commit/5b9c3469085e01c79e2d0af28e2a13f730e1793d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/harttle/liquidjs/releases/tag/v10.26.0", "name": "https://github.com/harttle/liquidjs/releases/tag/v10.26.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the renderLimit option can be fully bypassed by a {% for %} (or {% tablerow %}) tag whose body is empty. The renderLimit option is documented in docs/source/tutorials/dos.md as the mechanism that \"mitigates this by limiting the time consumed by each render() call.\" The per-iteration time check is reached only when the body contains at least one template node, so a template such as {%- for i in (1..N) -%}{%- endfor -%} iterates the full collection without ever consulting renderLimit. With a configured renderLimit of 50 ms, a single parseAndRenderSync call has been observed to consume 2.26 seconds (~45\u00d7 over the limit) and scales linearly with N up to memoryLimit, allowing a low-privileged template author to wedge an event-loop thread for an attacker-chosen duration. Deployments that rely on a finite renderLimit for DoS protection (common in multi-tenant template-authoring environments) can still be forced by a single crafted template to monopolize a Node.js event-loop worker for attacker-controlled time, potentially stalling in-flight requests, with availability impact only. This issue has been fixed in version 10.26.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-17T22:08:19.354Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44645", "state": "PUBLISHED", "dateUpdated": "2026-06-18T19:05:32.418Z", "dateReserved": "2026-05-07T15:30:10.875Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-17T22:08:19.354Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "liquidjs", "vendor": "harttle", "versions": [{"status": "affected", "version": "< 10.26.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the renderLimit option can be fully bypassed by a {% for %} (or {% tablerow %}) tag whose body is empty. The renderLimit option is documented in docs/source/tutorials/dos.md as the mechanism that \"mitigates this by limiting the time consumed by each render() call.\" The per-iteration time check is reached only when the body contains at least one template node, so a template such as {%- for i in (1..N) -%}{%- endfor -%} iterates the full collection without ever consulting renderLimit. With a configured renderLimit of 50 ms, a single parseAndRenderSync call has been observed to consume 2.26 seconds (~45\u00d7 over the limit) and scales linearly with N up to memoryLimit, allowing a low-privileged template author to wedge an event-loop thread for an attacker-chosen duration. Deployments that rely on a finite renderLimit for DoS protection (common in multi-tenant template-authoring environments) can still be forced by a single crafted template to monopolize a Node.js event-loop worker for attacker-controlled time, potentially stalling in-flight requests, with availability impact only. This issue has been fixed in version 10.26.0."}, {"lang": "es", "value": "LiquidJS es un motor de plantillas compatible con Shopify/GitHub Pages escrito en JavaScript puro. En las versiones 10.25.7 e inferiores, la opci\u00f3n renderLimit puede ser completamente eludida por una etiqueta {% for %} (o {% tablerow %}) cuyo cuerpo est\u00e1 vac\u00edo. La opci\u00f3n renderLimit est\u00e1 documentada en docs/source/tutorials/dos.md como el mecanismo que \u2019mitiga esto limitando el tiempo consumido por cada llamada a render()\u2019. La verificaci\u00f3n de tiempo por iteraci\u00f3n se alcanza solo cuando el cuerpo contiene al menos un nodo de plantilla, por lo que una plantilla como {%- for i in (1..N) -%}{%- endfor -%} itera la colecci\u00f3n completa sin consultar nunca renderLimit. Con un renderLimit configurado de 50 ms, se ha observado que una sola llamada a parseAndRenderSync consume 2.26 segundos (~45\u00d7 por encima del l\u00edmite) y escala linealmente con N hasta memoryLimit, permitiendo a un autor de plantillas con bajos privilegios encallar un hilo del bucle de eventos por una duraci\u00f3n elegida por el atacante. Las implementaciones que dependen de un renderLimit finito para la protecci\u00f3n contra DoS (com\u00fan en entornos de autor\u00eda de plantillas multi-inquilino) a\u00fan pueden ser forzadas por una \u00fanica plantilla dise\u00f1ada para monopolizar un worker del bucle de eventos de Node.js por un tiempo controlado por el atacante, lo que podr\u00eda estancar las solicitudes en curso, con solo un impacto en la disponibilidad. Este problema ha sido solucionado en la versi\u00f3n 10.26.0."}], "id": "CVE-2026-44645", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44645", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-18T19:05:03.703365Z", "version": "2.0.3"}}]}, "published": "2026-06-17T23:17:03.607", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/harttle/liquidjs/commit/5b9c3469085e01c79e2d0af28e2a13f730e1793d"}, {"source": "security-advisories@github.com", "url": "https://github.com/harttle/liquidjs/releases/tag/v10.26.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-8xx9-69p8-7jp3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-8xx9-69p8-7jp3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.26.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "liquidjs", "source": "cna", "vendor": "harttle"}, "product": "liquidjs", "vendor": "harttle"}], "created": "2026-06-18T19:30:15.321186+00:00", "updated": "2026-06-18T20:00:15.057849+00:00", "vendors": ["harttle", "harttle$PRODUCT$liquidjs"]}