Description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In strip_html, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a<. This issue is fixed in version 10.27.1.
Published: 2026-08-19
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an infinite loop in LiquidJS's strip_html filter triggered by an input string that contains a '<' character but no matching '>'. This loop can be entered with a minimal payload such as 'a<', causing the rendering engine to become stuck. The result is a denial of service as the template rendering cannot complete, potentially stalling the entire application or HTTP request until it times out or is killed.

Affected Systems

The issue affects the LiquidJS library from version 10.26.0 to 10.27.1, inclusive. It is implemented by the project maintainer harttle under the package name liquidjs. The fix is included in version 10.27.1 and later releases.

Risk and Exploitability

The vulnerability has a CVSS score of 8.7, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The attack path is straightforward: any template that invokes the strip_html filter with crafted user input can trigger the infinite loop. No special privileges are required beyond the ability to supply input to the template rendering process. The impact is a denial of service that can affect application availability, and the risk is high due to the wide use of LiquidJS in web applications.

Generated by OpenCVE AI on August 20, 2026 at 07:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade LiquidJS to version 10.27.1 or later to incorporate the fixed strip_html logic.
  • If upgrading immediately is not possible, validate template input to reject any string containing '<' without a matching '>' before it reaches the strip_html filter.
  • Implement a rendering timeout or watchdog process to terminate template execution after a defined period to prevent a hanging loop from exhausting resources.

Generated by OpenCVE AI on August 20, 2026 at 07:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-m7fp-h3p4-hr49 LiquidJS has an infinite loop vulnerability in its `strip_html` filter
History

Tue, 25 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Harttle
Harttle liquidjs
Vendors & Products Harttle
Harttle liquidjs

Wed, 19 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In strip_html, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a<. This issue is fixed in version 10.27.1.
Title LiquidJS: An infinite loop vulnerability in `strip_html` filter
Weaknesses CWE-835
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Harttle Liquidjs
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-25T14:16:38.259Z

Reserved: 2026-07-10T16:48:39.923Z

Link: CVE-2026-61556

cve-icon Vulnrichment

Updated: 2026-08-25T14:15:36.594Z

cve-icon NVD

Status : Received

Published: 2026-08-19T21:17:03.633

Modified: 2026-08-25T15:16:35.693

Link: CVE-2026-61556

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T08:00:03Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')