The vulnerability lies in LiquidJS’s join and array_to_sentence_string filters, which incorrectly account for memory usage by considering only array length and separator length rather than the full string produced by joining. An attacker can supply a crafted template that lets the concat filter double array references cheaply, then cause join to materialize vastly larger data while charging only for element count. This lets a template exceed the configured memoryLimit and crash the JavaScript engine, causing a denial of service. The weakness is an uncontrolled resource consumption flaw as identified by CWE‑400.

The issue affects the LiquidJS library from the vendor harttle. All releases prior to version 10.27.2 are vulnerable. Versions 10.27.2 and newer contain the fix; the join and array_to_sentence_string filters are now correctly accounted for.

The CVSS score of 7.5 indicates a high severity vulnerability, and the EPSS score is not available, suggesting no publicly known exploitation trend at the time. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker who can influence template authoring or supply templates to the application. The attack path involves creating a template that exploits the filters to exceed memory limits, which can crash the Node.js process. Thus, risk is moderate to high for exposed template engines.