PT-2026-31349 · Liquidjs · Liquidjs

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-35525

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.25.3

Description LiquidJS does not resolve the canonical filesystem path before opening files when processing {% include %}, {% render %}, and {% layout %} directives. This allows an attacker to leverage symlinks placed within allowed partials or layouts directories to access and render files outside the intended template root. The issue arises because the path-based check for directory containment is bypassed when a symlink points to a file outside the allowed root. This could potentially expose arbitrary readable files. The vulnerability is relevant in environments where an attacker can influence files under a trusted template root, such as uploaded themes or repository-controlled template trees.

Recommendations Update LiquidJS to version 10.25.3 or later.

Fix

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2026-35525

GHSA-56P5-8MHR-2FPH

Affected Products

Liquidjs

References · 7

• https://github.com/harttle/liquidjs/security/advisories/GHSA-56p5-8mhr-2fph · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35525 · Security Note
• https://osv.dev/vulnerability/GHSA-56p5-8mhr-2fph · Vendor Advisory
• https://github.com/harttle/liquidjs · Note
• https://github.com/harttle/liquidjs/releases/tag/v10.25.3 · Note
• https://github.com/harttle/liquidjs/pull/867 · Note
• https://twitter.com/VulmonFeeds/status/2042003667813806295 · Twitter Post