Is CVE-2026-30952 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30952 being exploited in the wild.

How severe is CVE-2026-30952?

Medium severity, with a CVSS score of 4, published 10 March 2026.

Which products and versions are affected?

liquidjs (npm) SEMVER:introduced=0,fixed=10.25.0.

Is there a fix for CVE-2026-30952?

Yes. liquidjs (npm): upgrade to 10.25.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30952 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-30952?

Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30952: liquidjs path traversal in file resolution fallback

CVE-2026-30952 · Severity: medium · CVSS 4 · Published 2026-03-10

LiquidJS is a template engine library used in web applications to render dynamic content. The library's layout, render, and include tags can be exploited to access arbitrary files on the server when malicious users control template content or file paths. An attacker could read sensitive configuration files, source code, or other protected data, leading to exposure of confidential information and potential further system compromise.

Technologies: liquidjs (npm). Vendors: npm.

Quick answers

Is CVE-2026-30952 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30952 being exploited in the wild.
How severe is CVE-2026-30952?: Medium severity, with a CVSS score of 4, published 10 March 2026.
Which products and versions are affected?: liquidjs (npm) SEMVER:introduced=0,fixed=10.25.0.
Is there a fix for CVE-2026-30952?: Yes. liquidjs (npm): upgrade to 10.25.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30952 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-30952?: Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

liquidjs (npm): upgrade to 10.25.0 or later
```
npm install liquidjs@10.25.0
```

Technical details

This is a path traversal vulnerability (CWE-22) in LiquidJS's file resolution mechanism. The root cause is that the library uses require.resolve() as a fallback method for locating template files but does not properly restrict resolution to an allowed directory root. The layout, render, and include tags accept both absolute file paths as string literals and paths via Liquid variables (with dynamicPartials enabled by default). An attacker controlling template content or file path variables can resolve and read arbitrary files on the filesystem. The vulnerability is fixed in version 10.25.0, which adds directory containment checks (checking if resolved paths are within allowed directories) before yielding file paths. Affected versions prior to 10.25.0 are vulnerable when templates or file paths come from untrusted sources.

Affected products

LiquidJS liquidjs < 10.25.0

Identifiers

CVE-2026-30952
GHSA-wmfp-5q7x-987x

Timeline

2026-03-10: disclosed
2026-03-10: patched: Version 10.25.0 released with fix

References

https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.