liquidjs vulnerabilities (npm)
19 vulnerabilities.
-
liquidjsnpm LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration 6.0 Medium -
liquidjsnpm LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process 7.5 High -
liquidjsnpm LiquidJS: An infinite loop vulnerability in `strip_html` filter 8.7 High -
liquidjsnpm LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce 8.2 High -
liquidjsnpm LiquidJS is Vulnerable to Remote Code Execution 10.0 Critical -
liquidjsnpm LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex 7.5 High -
liquidjsnpm LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime) 7.5 High -
liquidjsnpm LiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()` 5.3 Medium -
liquidjsnpm LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body 6.5 Medium -
liquidjsnpm LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS 6.1 Medium -
liquidjsnpm LiquidJS is vulnerable to Denial of Service via circular block reference in layout 7.5 High -
liquidjsnpm LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read 6.3 Medium -
liquidjsnpm LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel 5.3 Medium -
liquidjsnpm LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates 8.2 High -
liquidjsnpm LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter 3.7 Low -
liquidjsnpm LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern 7.5 High -
liquidjsnpm LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash 7.5 High -
liquidjsnpm liquidjs has a path traversal fallback vulnerability 8.7 High -
liquidjsnpm Information Exposure 5.3 Medium