LiquidJS, a plain‑JavaScript template engine used by Shopify and GitHub Pages, contains a flaw in its sort_natural filter that bypasses the ownPropertyOnly security option. By exploiting a sorting side‑channel, a malicious template can read prototype‑inherited properties such as API keys and tokens. This leakage is a privacy breach, classified as CWE‑200, and threatens the confidentiality of data in multi‑tenant systems that rely on ownPropertyOnly as a guardrail.

All deployments that use liquidjs version 10.25.3 or earlier are impacted. The affected product is the liquidjs library (vendor Harttle). Applications that enforce ownPropertyOnly: true to isolate tenant templates, such as Shopify or custom GitHub Pages configurations, are at risk of inadvertently exposing prototype information.

The vulnerability scores a CVSS of 5.3, indicating moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation. This vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attack vector requires a malicious template rendering that invokes sort_natural to probe prototype properties. If an attacker can supply arbitrary templates, the vulnerability could be exploited in any environment that processes untrusted templates, potentially exposing sensitive configuration data.