PT-2026-51120 · Pypi · Python-Liquid
Publicado
2026-06-19
·
Atualizado
2026-06-19
·
CVE-2026-55865
CVSS v4.0
5.3
Média
| Vetor | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
Impact
Given a malformed
{% case %} tag without associated {% when %} or {% else %} block, and no terminating {% endcase %} tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack.Patches
The issue is fixed in version 2.2.1 with the correction of the
liquid.TokenStream.eof attribute. The kind and value of the special EOF token are now the same, so either can be tested against liquid.token.TOKEN EOF.Workarounds
Manually correct the definition of
liquid.TokenStream.eof before parsing any templates.python
import liquid
from liquid.token import TOKEN EOF
liquid.stream.TokenStream.eof = liquid.Token(TOKEN EOF, TOKEN EOF, -1, "")
# ...Correção
Infinite Loop
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Python-Liquid