PT-2026-31354 · Shopify · Liquidjs

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-39859

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.25.3

Description LiquidJS is a template engine compatible with Shopify and GitHub Pages. Prior to version 10.25.3, the software does not properly enforce root directory constraints when handling file loads. A Liquid instance configured with an empty temporary directory as the root can return the contents of arbitrary files. This occurs because top-level file loads do not enforce the same boundary checks as renderFile() and parseFile(). The issue resides in the file loading APIs, specifically within src/parser/parser.ts and src/fs/loader.ts. The vulnerability allows an attacker to disclose arbitrary local files readable by the server process by exploiting the lack of containment checks for LookupType.Root. The proof of concept demonstrates successful rendering of /etc/hosts when root is set to an empty directory.

Recommendations Update to LiquidJS version 10.25.3 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-39859

GHSA-V273-448J-V4QJ

Affected Products

Liquidjs

References · 8

• https://github.com/harttle/liquidjs/security/advisories/GHSA-v273-448j-v4qj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39859 · Security Note
• https://osv.dev/vulnerability/GHSA-v273-448j-v4qj · Vendor Advisory
• https://github.com/harttle/liquidjs · Note
• https://github.com/harttle/liquidjs/releases/tag/v10.25.5 · Note
• https://github.com/harttle/liquidjs/commit/f41c1fc02fe901598f3328118b42b13bc6bc9b04 · Note
• https://github.com/harttle/liquidjs/pull/870 · Note
• https://twitter.com/VulmonFeeds/status/2041990866605162728 · Twitter Post