This vulnerability occurs when LiquidJS loads partial or layout templates through {% include %}, {% render %}, or {% layout %} tags. The engine checks that the requested path is inside the configured root directories using a string comparison, but it does not resolve the actual filesystem path. Therefore a symlink placed under the partials or layouts root that points to a file outside the allowed directory can be loaded and executed. An attacker who can create or modify a symlink in the trusted template tree can thus have LiquidJS render a malicious template or read sensitive files, which may lead to remote code execution or information disclosure. The flaw is a classic path‑traversal/symlink abuse (CWE‑61).

Products affected are LiquidJS libraries released by harttle. Any installation using a version earlier than 10.25.3 is vulnerable. The issue is documented for all variants of LiquidJS that support include, render, or layout tags, as the root restriction check is universal across them.

The CVSS base score for this flaw is 8.2, indicating a high severity. Attackers require the ability to place or modify a symlink within the allowed partials or layout directories, a capability that exists in environments where user input can influence uploaded themes, theme archives, or repository‑controlled template trees. The EPSS score is below 1 %, suggesting few exploitable public deployments at present, and the vulnerability is not present in CISA's KEV catalog. Nonetheless, once an attacker can write to the template root, exploitation is straightforward and could achieve code execution under the privileges of the running application. Implementing the fix removes the path containment flaw and eliminates the possibility of executing unintended templates.