Executive brief
LiquidJS is a template engine used to generate web content, similar to those used by Shopify and GitHub Pages. A flaw in its memory management allows an attacker to bypass safety limits designed to prevent the application from using too much memory. By providing a specially crafted template, an attacker can cause the server to crash or become unresponsive, leading to a denial of service.
Technical details
A vulnerability exists in the 'replace' filter of LiquidJS where memory usage is incorrectly accounted for when the 'memoryLimit' option is enabled. The engine charges the sum of the input lengths (string, pattern, and replacement) to the memory limiter, but the actual output generated by 'str.split(pattern).join(replacement)' can be quadratically larger if the pattern occurs frequently. An attacker controlling template content can achieve approximately 2,500x memory amplification, bypassing DoS protections to cause out-of-memory (OOM) conditions. This issue is fixed in version 10.25.3 by accurately calculating the output size based on the number of pattern occurrences.
Affected products
- harttle LiquidJS < 10.25.3
Timeline
- 2026-04-06: patched: Fix committed in version 10.25.3
- 2026-04-08: advisory: GitHub Security Advisory published
- 2026-04-08: disclosed