CVE-2026-45357

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45357", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-11T21:40:08.179Z", "datePublished": "2026-06-17T22:32:20.643Z", "dateUpdated": "2026-06-18T12:49:15.361Z"}, "containers": {"cna": {"title": "LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime)", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q"}, {"name": "https://github.com/harttle/liquidjs/commit/3129d46dc95efa357b00e5a57ee1af80a13d72ed", "tags": ["x_refsource_MISC"], "url": "https://github.com/harttle/liquidjs/commit/3129d46dc95efa357b00e5a57ee1af80a13d72ed"}, {"name": "https://github.com/harttle/liquidjs/releases/tag/v10.26.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/harttle/liquidjs/releases/tag/v10.26.0"}], "affected": [{"vendor": "harttle", "product": "liquidjs", "versions": [{"version": "< 10.26.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-17T22:32:20.643Z"}, "descriptions": [{"lang": "en", "value": "LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, so a single small template ({{ x | date: '%5000000d' }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src/liquid-options.ts:87-92) advertise as DoS controls \u2014 and which the docstring explicitly mentions for strftime \u2014 are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0."}], "source": {"advisory": "GHSA-hh27-hf48-9f5q", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-18T12:48:36.994250Z", "id": "CVE-2026-45357", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-18T12:49:15.361Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45357", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-18T12:48:36.994250Z"}}}], "references": [{"url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-18T12:47:54.507Z"}}], "cna": {"title": "LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime)", "source": {"advisory": "GHSA-hh27-hf48-9f5q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "harttle", "product": "liquidjs", "versions": [{"status": "affected", "version": "< 10.26.0"}]}], "references": [{"url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q", "name": "https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/harttle/liquidjs/commit/3129d46dc95efa357b00e5a57ee1af80a13d72ed", "name": "https://github.com/harttle/liquidjs/commit/3129d46dc95efa357b00e5a57ee1af80a13d72ed", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/harttle/liquidjs/releases/tag/v10.26.0", "name": "https://github.com/harttle/liquidjs/releases/tag/v10.26.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, so a single small template ({{ x | date: '%5000000d' }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src/liquid-options.ts:87-92) advertise as DoS controls \u2014 and which the docstring explicitly mentions for strftime \u2014 are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-17T22:32:20.643Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45357", "state": "PUBLISHED", "dateUpdated": "2026-06-18T12:49:15.361Z", "dateReserved": "2026-05-11T21:40:08.179Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-17T22:32:20.643Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "liquidjs", "vendor": "harttle", "versions": [{"status": "affected", "version": "< 10.26.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, so a single small template ({{ x | date: '%5000000d' }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src/liquid-options.ts:87-92) advertise as DoS controls \u2014 and which the docstring explicitly mentions for strftime \u2014 are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0."}, {"lang": "es", "value": "LiquidJS es un motor de plantillas compatible con Shopify/GitHub Pages escrito en JavaScript puro. En las versiones 10.25.7 e inferiores, la implementaci\u00f3n de strftime del filtro de fecha analiza especificadores de ancho como %9999999d y reenv\u00eda el ancho capturado sin verificar a pad()/padStart(), lo que lleva a la omisi\u00f3n de los l\u00edmites de memoria y renderizado. En src/util/underscore.ts, el bucle de relleno realiza una concatenaci\u00f3n de cadenas ilimitada sin consultar memoryLimit o renderLimit del Contexto, por lo que una \u00fanica plantilla peque\u00f1a ({{ x | date: \u2019%5000000d\u2019 }}) produce megabytes de salida y un uso ilimitado de CPU. Las opciones memoryLimit y renderLimit que la documentaci\u00f3n (src/liquid-options.ts:87-92) anuncia como controles de DoS -y que la cadena de documentaci\u00f3n menciona expl\u00edcitamente para strftime- son completamente omitidas. La explotaci\u00f3n puede causar grandes asignaciones de memoria, alto uso de CPU o fallos OOM por renderizado. Este problema ha sido solucionado en la versi\u00f3n 10.26.0."}], "id": "CVE-2026-45357", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45357", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-18T12:48:36.994250Z", "version": "2.0.3"}}]}, "published": "2026-06-17T23:17:03.893", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/harttle/liquidjs/commit/3129d46dc95efa357b00e5a57ee1af80a13d72ed"}, {"source": "security-advisories@github.com", "url": "https://github.com/harttle/liquidjs/releases/tag/v10.26.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.26.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "liquidjs", "source": "cna", "vendor": "harttle"}, "product": "liquidjs", "vendor": "harttle"}], "created": "2026-06-18T19:15:02.358415+00:00", "updated": "2026-06-18T19:15:02.436535+00:00", "vendors": ["harttle", "harttle$PRODUCT$liquidjs"]}