AIKIDO-2026-574329

TL;DR

The strip_html filter in liquidjs enters an infinite loop when its input contains a < character that has at least one preceding character and no following >. An internal index fails to advance for that input, so the loop never reaches its exit condition. A short crafted string such as a< passed through the filter hangs the rendering thread and denies service. The fix corrects the loop exit condition so the index always advances past the unmatched <.