LiquidJS’s pop array filter clones its input array using, creating an O(N) duplicate that bypasses the configured memory budget. An attacker who can influence the array passed to {{ huge_array | pop }} can trigger the filter to allocate a large internal array, exhausting server memory and causing the rendering process to crash or behave erratically. The vulnerability maps to CWE‑770 – Excessive Resource Consumption, resulting in a memory exhaustion condition that compromises availability, not confidentiality or integrity.

All deployments of Harttle’s LiquidJS template engine running a version older than 10.27.1 are affected, regardless of platform, including Shopify or GitHub Pages. Version 10.27.1 and later contain the fix that enforces proper memory accounting for the pop filter.

The CVSS score of 8.2 signals high severity, while an EPSS score of < 1% indicates a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KE an attacker needs to supply a template that contains a large array, a scenario common in web applications and content management systems that render user‑supplied templates. Exploitation leads to denial‑of‑service by exhausting memory unresponsiveness.