Liquidjs, a JavaScript template engine used by Shopify and GitHub Pages, contains a path traversal flaw when its layout, render, or include tags are used with absolute paths. The vulnerability allows an attacker that can influence the template content or supply the path as a variable to read any file accessible to the running process. This flaw is classified as a CWE‑22 Path Traversal and is reflected in the CVSS score of 8.7, indicating high impact on confidentiality.

The flaw affects installations of harttle’s Liquidjs package before version 10.25.0 when executed in a Node.js environment. Any Node.js application that incorporates older versions of Liquidjs and renders templates supplied by untrusted users or external entities is at risk.

The risk is high due to the CVSS score, yet the EPSS score of less than 1% suggests that exploitation is currently low probability. Based on the description, it is inferred that the vulnerability does not require elevated privileges or network addressability beyond application exposure, and it is not listed in CISA’s KEV catalog. Attackers would typically supply malicious template code or set the include path variable to access sensitive files, making the threat most likely for web applications that permit user‑generated template content.