Executive brief
LiquidJS is a template engine library used in web applications to render dynamic content. The library's layout, render, and include tags can be exploited to access arbitrary files on the server when malicious users control template content or file paths. An attacker could read sensitive configuration files, source code, or other protected data, leading to exposure of confidential information and potential further system compromise.
Technical details
This is a path traversal vulnerability (CWE-22) in LiquidJS's file resolution mechanism. The root cause is that the library uses require.resolve() as a fallback method for locating template files but does not properly restrict resolution to an allowed directory root. The layout, render, and include tags accept both absolute file paths as string literals and paths via Liquid variables (with dynamicPartials enabled by default). An attacker controlling template content or file path variables can resolve and read arbitrary files on the filesystem. The vulnerability is fixed in version 10.25.0, which adds directory containment checks (checking if resolved paths are within allowed directories) before yielding file paths. Affected versions prior to 10.25.0 are vulnerable when templates or file paths come from untrusted sources.
Affected products
- LiquidJS liquidjs < 10.25.0
Timeline
- 2026-03-10: disclosed
- 2026-03-10: patched: Version 10.25.0 released with fix