AIKIDO-2026-500277
liquidjs is vulnerable to Information Disclosure
36
Low Risk
This Affects:
liquidjsTL;DR
When ownPropertyOnly is enabled, liquidjs is meant to hide prototype-inherited properties, but array first/last accessors and (later) negative index reads skip that check. A template can read inherited array-index values from the prototype chain. The fix routes those reads through a helper that honors own-property status. Positive a[i] access was already gated.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range, ownPropertyOnly is enabled (the default on 10.x), and templates read first, last, or negative indexes on arrays that can inherit index properties from their prototype.
Background info
liquidjs is vulnerable to Information Disclosure in versions 9.34.0 - 10.27.1.
How to fix this
Upgrade the liquidjs library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant