Is CVE-2026-106120 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106120 being exploited in the wild.

How severe is CVE-2026-106120?

Medium severity, with a CVSS score of 4, published 6 October 2026.

Which products and versions are affected?

Harttle LiquidJS before 10.27.2; liquidjs (npm) <= 10.27.1, SEMVER:introduced=0,fixed=10.27.2.

How is CVE-2026-106120 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106120?

Check whether you run Harttle LiquidJS or liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106120: LiquidJS ownPropertyOnly bypass via inherited array indices

Q: Is there a fix for CVE-2026-106120?

Yes. liquidjs (npm): upgrade to 10.27.2 or later. Until then: If your data may carry a polluted Array.prototype or Object.prototype, sanitize it before passing it to LiquidJS to prevent prototype-inherited indices from being exposed through template filters and iteration. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-106120 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-106120?

Check whether you run Harttle LiquidJS or liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106120 · Severity: medium · CVSS 4 · Published 2026-10-06

LiquidJS is a template engine used to render dynamic content in web applications. When the ownPropertyOnly security setting is enabled to restrict access to certain object properties, an attacker can bypass this restriction by manipulating prototype chains and then using specific template operations (like negative array indexing, .first, .last filters, or for-loop iteration) to read hidden values. This allows unauthorized information disclosure from templates that should be protected.

Technologies: liquidjs (npm). Vendors: Harttle, npm.

Quick answers

Is CVE-2026-106120 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106120 being exploited in the wild.
How severe is CVE-2026-106120?: Medium severity, with a CVSS score of 4, published 6 October 2026.
Which products and versions are affected?: Harttle LiquidJS before 10.27.2; liquidjs (npm) <= 10.27.1, SEMVER:introduced=0,fixed=10.27.2.
Is there a fix for CVE-2026-106120?: Yes. liquidjs (npm): upgrade to 10.27.2 or later. Until then: If your data may carry a polluted Array.prototype or Object.prototype, sanitize it before passing it to LiquidJS to prevent prototype-inherited indices from being exposed through template filters and iteration. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106120 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106120?: Check whether you run Harttle LiquidJS or liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

liquidjs (npm): upgrade to 10.27.2 or later
```
npm install liquidjs@10.27.2
```

If your data may carry a polluted Array.prototype or Object.prototype, sanitize it before passing it to LiquidJS to prevent prototype-inherited indices from being exposed through template filters and iteration.

Technical details

The ownPropertyOnly option in LiquidJS failed to consistently block access to inherited array indices through multiple code paths: negative indexing, .first/.last property accessors, first/last filters, join, reverse, slice, compact, and for-loop iteration bypassed the readJSProperty() checks. An attacker who can influence prototype state or inject inherited array-index data can read values that ownPropertyOnly is intended to hide. Direct positive indexing and ordinary object prototype reads were blocked, but alternate array access methods remained vulnerable.

Affected products

harttle LiquidJS before 10.27.2

Identifiers

CVE-2026-106120
GHSA-fwxr-j5w2-587m

Timeline

2026-10-06: disclosed
2026-07-06: patched: Fix committed on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.