# CVE-2022-25948: LiquidJS prototype property information exposure

Source: https://junglewise.ai/threats/cve-2022-25948-liquidjs-prototype-property-information-exposure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-12-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-25948 · Severity: low · CVSS 3.1 · Published 2022-12-22

LiquidJS is a popular template engine used to process Liquid templates in JavaScript applications. When misconfigured with ownPropertyOnly set to false, the engine exposes JavaScript prototype properties—including internal functions and built-in object methods—to template code. An attacker who can control template input could exploit this to access sensitive prototype information, potentially leading to information disclosure or further exploitation.

Technologies: [liquidjs (npm)](https://junglewise.ai/threats/technologies/liquidjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-25948 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-25948 being exploited in the wild.

**How severe is CVE-2022-25948?** Low severity, with a CVSS score of 3.1, published 22 December 2022.

**Which products and versions are affected?** liquidjs (npm) SEMVER:introduced=0,fixed=10.0.0.

**Is there a fix for CVE-2022-25948?** Yes. liquidjs (npm): upgrade to 10.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-25948 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-25948?** Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- liquidjs (npm): upgrade to 10.0.0 or later

  ```sh
  npm install liquidjs@10.0.0
  ```


## Technical details

The vulnerability is an information exposure flaw (CWE-200) affecting LiquidJS versions before 10.0.0. When the ownPropertyOnly parameter is set to false (the default prior to v10.0.0), template evaluation does not properly restrict access to prototype chain properties. An attacker providing malicious Liquid templates can access prototype getter functions and other inherited properties (such as .length or other Object prototype methods). This requires no authentication and can be triggered by any user input passed to the template engine. The fix was introduced in version 10.0.0 by changing the default value of ownPropertyOnly to true, and a partial workaround was available starting in version 9.34.0 via the ownPropertyOnly option.

## Affected products

- harttle liquidjs before 10.0.0

## Identifiers

- CVE-2022-25948
- GHSA-45rm-2893-5f49

## Timeline

- 2022-12-22: disclosed: Advisory published
- 2022-12-22: patched: Fix included in version 10.0.0; workaround available in 9.34.0+

## References

- [https://github.com/harttle/liquidjs/issues/454](https://github.com/harttle/liquidjs/issues/454)
- [https://github.com/harttle/liquidjs/commit/7e99efc5131e20cf3f59e1fc2c371a15aa4109db](https://github.com/harttle/liquidjs/commit/7e99efc5131e20cf3f59e1fc2c371a15aa4109db)
- [https://github.com/harttle/liquidjs/commit/7eb621601c2b05d6e379e5ce42219f2b1f556208](https://github.com/harttle/liquidjs/commit/7eb621601c2b05d6e379e5ce42219f2b1f556208)
- [https://github.com/harttle/liquidjs](https://github.com/harttle/liquidjs)
- [https://groups.google.com/u/0/a/snyk.io/g/report/c/9ipXecWRtTM/m/IgLadevtCQAJ](https://groups.google.com/u/0/a/snyk.io/g/report/c/9ipXecWRtTM/m/IgLadevtCQAJ)
- [https://security.snyk.io/vuln/SNYK-JS-LIQUIDJS-2952868](https://security.snyk.io/vuln/SNYK-JS-LIQUIDJS-2952868)

## Related threats

- [LiquidJS ownPropertyOnly bypass via inherited array indices](https://junglewise.ai/threats/cve-2026-106120-liquidjs-is-a-shopify-github-pages-compatible-template-engine-in)
- [LiquidJS join filter uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-69222-liquidjs-uncontrolled-resource-consumption-in-join-filter)
- [LiquidJS infinite loop in strip_html filter](https://junglewise.ai/threats/cve-2026-61556-liquidjs-infinite-loop-in-strip-html-filter)
- [LiquidJS remote code execution via crafted templates](https://junglewise.ai/threats/cve-2026-45618-liquidjs-remote-code-execution-via-crafted-templates)
- [LiquidJS memory limit bypass in pop array filter](https://junglewise.ai/threats/cve-2026-55575-liquidjs-memory-limit-bypass-in-pop-array-filter)