PT-2026-31351 · Liquidjs · Liquidjs

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-39412

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: LiquidJS versions prior to 10.25.4

Description: LiquidJS is a template engine. A bypass exists in the sort natural filter regarding the ownPropertyOnly security option. This allows template authors to extract values of prototype-inherited properties through a sorting side-channel attack. Applications relying on ownPropertyOnly: true as a security boundary are vulnerable to information disclosure of sensitive prototype properties, such as API keys and tokens. The sort natural function (lines 40-48 in src/filters/array.ts) accesses object properties directly, bypassing the hasOwnProperty check used in other parts of the codebase when ownPropertyOnly is enabled. A proof-of-concept demonstrates that the sort natural filter can be used to reveal the order of prototype-inherited properties, allowing an attacker to extract secrets character-by-character through binary search.

Recommendations: Update to LiquidJS version 10.25.4 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-39412

GHSA-RV5G-F82M-QRVV

Affected Products

Liquidjs

References · 8

• 🔥 https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv · Exploit
• https://github.com/harttle/liquidjs/commit/e743da0020d34e2ee547e1cc1a86b58377ebe1ce · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39412 · Security Note
• https://osv.dev/vulnerability/GHSA-rv5g-f82m-qrvv · Vendor Advisory
• https://github.com/harttle/liquidjs · Note
• https://github.com/harttle/liquidjs/releases/tag/v10.25.4 · Note
• https://github.com/harttle/liquidjs/pull/869 · Note
• https://twitter.com/VulmonFeeds/status/2041995986608734466 · Twitter Post