PT-2026-43458 · Git+2 · Liquidjs
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
LiquidJS versions prior to 10.26.0
Description
A flaw in the
strip html filter logic allows for Cross-Site Scripting (XSS). The filter is designed to remove HTML tags from strings to act as a sanitizer; however, it uses a regular expression where the catch-all branch (<.*?>) fails to match line terminators. Consequently, any HTML tag containing a newline ( ) or carriage return (r) character is passed through unmodified. Since web browsers treat these characters as whitespace within a tag, an attacker can bypass sanitization by inserting a newline into a tag (e.g., <img src=x onerror=alert(1)>), leading to the execution of arbitrary JavaScript. This occurs in applications that render attacker-controlled strings using the strip html filter and do not separately HTML-escape the output, which is the default behavior when the outputEscape variable is unset.Recommendations
Update to version 10.26.0 or later.
As a temporary workaround, avoid using the
strip html filter for sanitizing untrusted content and instead use the escape filter to HTML-escape output.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Liquidjs