The vulnerability permits an attacker to run arbitrary code whenever a malicious template is processed by LiquidJS. The engine lacks proper sanitisation of template expressions, allowing injected JavaScript code to be evaluated during rendering. This flaw is a classic code injection weakness (CWE‑94) and can lead to a full compromise of the application where the templating engine is deployed.

The flaw is present in every release of the LiquidJS library distributed by harttle prior to version 10.26.0. Any project that incorporates these versions – for example, Node.js back‑ends that render templates for Shopify or GitHub Pages – is exposed. Applications that use older versions of LiquidJS for templating should be reviewed for additional risk.

The CVSS score of 10 indicates the highest level of severity, while the EPSS score of less than 1% suggests that, as of now, the exploitation rate is very low. Nevertheless, the vulnerability is not listed in CISA's KEV catalog, meaning no confirmed exploitation has been reported. Because the flaw is triggered by user‑supplied templates, the attack vector is likely remote. Once a malicious template is supplied, arbitrary JavaScript execution occurs, giving attackers full control over the host process.