AIKIDO-2026-574329
liquidjs is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
liquidjsTL;DR
The strip_html filter in liquidjs enters an infinite loop when its input contains a < character that has at least one preceding character and no following >. An internal index fails to advance for that input, so the loop never reaches its exit condition. A short crafted string such as a< passed through the filter hangs the rendering thread and denies service. The fix corrects the loop exit condition so the index always advances past the unmatched <.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you apply the strip_html filter to untrusted or user-controlled input.
Background info
liquidjs is vulnerable to Denial of Service (DoS) in versions 10.26.0 - 10.27.0.
How to fix this
Upgrade the liquidjs library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.