The replace filter in LiquidJS miscalculates memory consumption when the memoryLimit option is active. It accounts only for the lengths of the source string, the pattern, and the replacement, yet the actual output from str.split(pattern).join(replacement) can explode quadratically when the pattern occurs many times. An attacker who controls template content can craft input that amplifies the output by roughly 2,500×, thereby evading the memory limiter and forcing an out‑of‑memory condition, which can crash the service or kill processes.

LiquidJS implementations bundled by Harttle are affected in all versions earlier than 10.25.3. The vulnerability exists in the patch‑free code base that ships with these older releases and is fixed in 10.25.3 and newer.

The CVSS score of 3.7 indicates a moderate severity. The EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitability requires the attacker to control template content and have the application run LiquidJS with the memoryLimit option enabled; no local privilege escalation or network attack vector is needed.