Is CVE-2026-35525 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35525 being exploited in the wild.

How severe is CVE-2026-35525?

High severity, with a CVSS score of 7.5, published 8 April 2026.

Which products and versions are affected?

liquidjs (npm) <= 10.25.2, SEMVER:introduced=0,fixed=10.25.3.

Is there a fix for CVE-2026-35525?

Yes. liquidjs (npm): upgrade to 10.25.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35525 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-35525?

Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35525: LiquidJS root restriction bypass via symlinks in template tags

Q: Which products and versions are affected?

liquidjs (npm) <= 10.25.2, SEMVER:introduced=0,fixed=10.25.3.

Q: Is there a fix for CVE-2026-35525?

Yes. liquidjs (npm): upgrade to 10.25.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-35525 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-35525?

Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35525 · Severity: high · CVSS 7.5 · Published 2026-04-08

LiquidJS is a JavaScript template engine used for rendering dynamic content in web applications. A vulnerability allows attackers who can place symlinks within trusted template directories to bypass path restrictions and read arbitrary files from the filesystem, potentially exposing sensitive data. This impacts applications that allow user-uploaded themes or templates.

Technologies: liquidjs (npm). Vendors: npm.

Quick answers

Is CVE-2026-35525 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35525 being exploited in the wild.
How severe is CVE-2026-35525?: High severity, with a CVSS score of 7.5, published 8 April 2026.
Which products and versions are affected?: liquidjs (npm) <= 10.25.2, SEMVER:introduced=0,fixed=10.25.3.
Is there a fix for CVE-2026-35525?: Yes. liquidjs (npm): upgrade to 10.25.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35525 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-35525?: Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

liquidjs (npm): upgrade to 10.25.3 or later
```
npm install liquidjs@10.25.3
```

Technical details

The vulnerability is a path traversal/symlink bypass (CWE-61) in LiquidJS's handling of template inclusion via {% include %}, {% render %}, and {% layout %} directives. LiquidJS validates that requested template paths are within configured root directories using string-based path comparisons rather than resolving canonical filesystem paths (realpath). When a template file is actually a symlink to an external path, the filesystem follows the symlink during file open, allowing access to files outside the intended root. Exploitation requires the ability to place symlinks or influence template files within a trusted root directory (e.g., uploaded themes, extracted archives, or mounted content). An attacker can render external files and potentially expose their contents. The vulnerability was patched in version 10.25.3 by implementing realpath-based containment checks.

Affected products

harttle liquidjs <=10.25.2

Identifiers

CVE-2026-35525
GHSA-56p5-8mhr-2fph

Timeline

2026-04-08: disclosed
2026-04-06: patched: Fixed in version 10.25.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.