PT-2026-28163 · Liquidjs · Liquidjs
Kodove
·
Published
2026-03-25
·
Updated
2026-03-26
·
CVE-2026-33287
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
LiquidJS versions prior to 10.25.1
Description
LiquidJS is susceptible to a denial of service condition due to insufficient memory limit enforcement within the
replace first filter. The filter utilizes JavaScript's String.prototype.replace(), which interprets $& as a back reference to the matched substring. This allows an attacker to achieve exponential memory amplification, potentially reaching a 625,000:1 ratio, while remaining within the defined memoryLimit. The replace first filter only accounts for the input string length when calculating memory usage, failing to consider the expanded output resulting from the $& expansion. This issue does not affect the replace or replace last filters, which handle $& as a literal string or use manual substring operations, respectively. A proof-of-concept (PoC) demonstrates that a small input string can be amplified to 312.5 MB, causing significant service disruption. Concurrent attacks with 20 requests can lead to legitimate user requests being delayed by up to 10.9 seconds, and the server becoming unresponsive for approximately 29 seconds. The vulnerability is triggered by crafting a malicious Liquid template containing repeated $& patterns within the replace first filter. The API endpoint used for exploitation is /render, which accepts user-provided Liquid templates via a POST request. The vulnerable parameter is template, which contains the malicious Liquid code.Recommendations
Update LiquidJS to version 10.25.1 or later.
Exploit
Fix
Resource Exhaustion
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Liquidjs