AIKIDO-2026-10837
liquidjs is vulnerable to Remote Code Execution (RCE)
99
Critical Risk
This Affects:
liquidjsTL;DR
The engine kept filter and tag registries on ordinary objects, so template-controlled names like valueOf or constructor resolved to inherited Object.prototype members. Invoking those names through the filter pipeline could return internal objects and expose parser, loader, and context state, with a confirmed chain to arbitrary code execution. Registries now use null-prototype objects so only explicitly registered filters and tags are reachable. Regression tests cover inherited names as filters and tags.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
liquidjs is vulnerable to Remote Code Execution (RCE) in versions 10.0.0 - 10.25.7.
How to fix this
Upgrade the liquidjs library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant