LiquidJS used by Shopify and GitHub Pages uses a strip_html filter to remove HTML tags from strings before rendering. The filter’s regular expression contains a catch‑all branch (<.*?>) that fails to match line terminators. As a result, any tag containing a newline or carriage‑return character passes through the filter unchanged. An attacker who can inject a newline within a tag, for example <img\nsrc=x\nonerror=alert(1)>, bypasses the intended sanitization. Because browsers treat newlines as whitespace inside tags, the embedded event handler is executed when the malicious markup is rendered. The vulnerability is exploitable in applications that render attacker‑controlled strings through {{ x | strip_html }} and do not separately HTML‑escape that output, which is the default behavior when outputEscape is unset.

The flaw affects any system that incorporates the harttle:liquidjs library, specifically all releases 10.25.7 and earlier. Upgrading to release 10.26.0 or later fixes the issue.

Organizations using LiquidJS face a medium‑risk XSS exposure. The CVSS score of 6.1 reflects this moderate severity, and an EPSS score of < 1 % indicates a very low but non‑zero probability of exploitation. The vulnerability is exploitable when user‑controlled strings are filtered through {{ x | strip_html }} without subsequent HTML‑escaping. Because the filter fails to block tags containing line terminators, an attacker can embed newline characters in the tag, causing browsers to execute injected event handlers. The issue is not listed in CISA KEV, but it can still be leveraged by attackers in environments that rely on strip_html for sanitization.