https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 14:05:11 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-45618 <p>LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.</p> <p>LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.</p> https://db.gcve.eu/vuln/fkie_cve-2026-45618 https://db.gcve.eu/vuln/ghsa-gf2q-c269-pqgc <p><strong>Affected:</strong> npm: liquidjs</p> <p>### Summary It is possible to execute arbitrary code with crafted templates</p> <p>### Details</p> <p>&lt;details&gt; &lt;summary&gt; `1|valueOf` -&gt; `this` when evaluating the filter</p> <p>&lt;/summary&gt;</p> <p>```liquid {%assign r=1|valueOf%} {{r|inspect}} ```</p> <p>```json {&#34;context&#34;:{&#34;scopes&#34;:[{&#34;r&#34;:&#34;[Circular]&#34;}],&#34;registers&#34;:{},&#34;breakCalled&#34;:false,&#34;continueCalled&#34;:false,&#34;sync&#34;:false,&#34;opts&#34;:{&#34;root&#34;:[&#34;.&#34;],&#34;layouts&#34;:[&#34;.&#34;],&#34;partials&#34;:[&#34;.&#34;],&#34;relativeReference&#34;:true,&#34;jekyllInclude&#34;:false,&#34;keyValueSeparator&#34;:&#34;:&#34;,&#34;extname&#34;:&#34;&#34;,&#34;fs&#34;:{&#34;sep&#34;:&#34;/&#34;},&#34;dynamicPartials&#34;:true,&#34;jsTruthy&#34;:false,&#34;dateFormat&#34;:&#34;%A, %B %-e, %Y at %-l:%M %P %z&#34;,&#34;locale&#34;:&#34;en-US&#34;,&#34;trimTagRight&#34;:false,&#34;trimTagLeft&#34;:false,&#34;trimOutputRight&#34;:false,&#34;trimOutputLeft&#34;:false,&#34;greedy&#34;:true,&#34;tagDelimiterLeft&#34;:&#34;{%&#34;,&#34;tagDelimiterRight&#34;:&#34;%}&#34;,&#34;outputDelimiterLeft&#34;:&#34;{{&#34;,&#34;outputDelimiterRight&#34;:&#34;}}&#34;,&#34;preserveTimezones&#34;:false,&#34;strictFilters&#34;:false,&#34;strictVariables&#34;:false,&#34;ownPropertyOnly&#34;:true,&#34;lenientIf&#34;:false,&#34;globals&#34;:{},&#34;keepOutputType&#34;:false,&#34;operators&#34;:{},&#34;memoryLimit&#34;:null,&#34;parseLimit&#34;:null,&#34;renderLimit&#34;:null},&#34;globals&#34;:{},&#34;environments&#34;:{},&#34;strictVariables&#34;:false,&#34;ownPropertyOnly&#34;:true,&#34;memoryLimit&#34;:{&#34;base&#34;:0,&#34;message&#34;:&#34;memory alloc limit exceeded&#34;,&#34;limit&#34;:null},&#34;renderLimit&#34;:{&#34;base&#34;:0,&#34;message&#34;:&#34;template render limit exceeded&#34;,&#34;limit&#34;:null}},&#34;token&#34;:{&#34;kind&#34;:32,&#34;input&#34;:&#34;{%assign r=1|valueOf%}\n{{r|inspect}}&#34;,&#34;begin&#34;:13,&#34;end&#34;:20,&#34;name&#34;:&#34;valueOf&#34;,&#34;args&#34;:[]},&#34;liquid&#34;:{&#34;renderer&#34;:{},&#34;filters&#34;:{&#34;raw&#34;:{&#34;raw&#34;:true}},&#34;tags&#34;:{},&#34;options&#34;:{&#34;root&#34;:[&#34;.&#34;],&#34;layouts&#34;:[&#34;.&#34;],&#34;partial…</p> <p><strong>Affected:</strong> npm: liquidjs</p> <p>### Summary It is possible to execute arbitrary code with crafted templates</p> <p>### Details</p> <p>&lt;details&gt; &lt;summary&gt; `1|valueOf` -&gt; `this` when evaluating the filter</p> <p>&lt;/summary&gt;</p> <p>```liquid {%assign r=1|valueOf%} {{r|inspect}} ```</p> <p>```json {&#34;context&#34;:{&#34;scopes&#34;:[{&#34;r&#34;:&#34;[Circular]&#34;}],&#34;registers&#34;:{},&#34;breakCalled&#34;:false,&#34;continueCalled&#34;:false,&#34;sync&#34;:false,&#34;opts&#34;:{&#34;root&#34;:[&#34;.&#34;],&#34;layouts&#34;:[&#34;.&#34;],&#34;partials&#34;:[&#34;.&#34;],&#34;relativeReference&#34;:true,&#34;jekyllInclude&#34;:false,&#34;keyValueSeparator&#34;:&#34;:&#34;,&#34;extname&#34;:&#34;&#34;,&#34;fs&#34;:{&#34;sep&#34;:&#34;/&#34;},&#34;dynamicPartials&#34;:true,&#34;jsTruthy&#34;:false,&#34;dateFormat&#34;:&#34;%A, %B %-e, %Y at %-l:%M %P %z&#34;,&#34;locale&#34;:&#34;en-US&#34;,&#34;trimTagRight&#34;:false,&#34;trimTagLeft&#34;:false,&#34;trimOutputRight&#34;:false,&#34;trimOutputLeft&#34;:false,&#34;greedy&#34;:true,&#34;tagDelimiterLeft&#34;:&#34;{%&#34;,&#34;tagDelimiterRight&#34;:&#34;%}&#34;,&#34;outputDelimiterLeft&#34;:&#34;{{&#34;,&#34;outputDelimiterRight&#34;:&#34;}}&#34;,&#34;preserveTimezones&#34;:false,&#34;strictFilters&#34;:false,&#34;strictVariables&#34;:false,&#34;ownPropertyOnly&#34;:true,&#34;lenientIf&#34;:false,&#34;globals&#34;:{},&#34;keepOutputType&#34;:false,&#34;operators&#34;:{},&#34;memoryLimit&#34;:null,&#34;parseLimit&#34;:null,&#34;renderLimit&#34;:null},&#34;globals&#34;:{},&#34;environments&#34;:{},&#34;strictVariables&#34;:false,&#34;ownPropertyOnly&#34;:true,&#34;memoryLimit&#34;:{&#34;base&#34;:0,&#34;message&#34;:&#34;memory alloc limit exceeded&#34;,&#34;limit&#34;:null},&#34;renderLimit&#34;:{&#34;base&#34;:0,&#34;message&#34;:&#34;template render limit exceeded&#34;,&#34;limit&#34;:null}},&#34;token&#34;:{&#34;kind&#34;:32,&#34;input&#34;:&#34;{%assign r=1|valueOf%}\n{{r|inspect}}&#34;,&#34;begin&#34;:13,&#34;end&#34;:20,&#34;name&#34;:&#34;valueOf&#34;,&#34;args&#34;:[]},&#34;liquid&#34;:{&#34;renderer&#34;:{},&#34;filters&#34;:{&#34;raw&#34;:{&#34;raw&#34;:true}},&#34;tags&#34;:{},&#34;options&#34;:{&#34;root&#34;:[&#34;.&#34;],&#34;layouts&#34;:[&#34;.&#34;],&#34;partial…</p> https://db.gcve.eu/vuln/ghsa-gf2q-c269-pqgc