AIKIDO-2026-746804
liquid is vulnerable to Denial of Service (DoS)
65
Medium Risk
This Affects:
liquidTL;DR
The for and tablerow tags iterate integer ranges before Liquid checks its render score limit. for converts the range into a full array with Range#to_a, and tablerow processes it fully with an unbounded each call, so a range such as (1..1000000000) gets materialized or fully processed regardless of size. Even an empty-body loop is not charged against the render score until after that full pass, so a single template statement can exhaust memory and CPU. The fix replaces both paths with a bounded RangeSlice window that charges each visited item, including empty-body iterations, before it runs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you render Liquid templates containing input from users you do not fully trust.
Background info
liquid is vulnerable to Denial of Service (DoS) in versions 1.9.0 - 5.13.0.
How to fix this
Upgrade the liquid library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.