Executive brief
LiquidJS is a template engine used to generate web content, similar to those used by Shopify and GitHub Pages. A security flaw in its sorting filters allows unauthorized users to view sensitive internal data, such as API keys or tokens, that should be protected. This is particularly dangerous for service providers who host multiple customers on the same system, as one user could potentially see another's private information.
Technical details
A vulnerability exists in LiquidJS where the 'sort' and 'sort_natural' filters bypass the 'ownPropertyOnly' security configuration. The root cause is the use of direct bracket notation (lhs[propertyString]) in the array filter implementation, which traverses the JavaScript prototype chain instead of using the library's internal scope-safe property accessors. An attacker with the ability to author templates can exploit this via a sorting side-channel attack to infer the values of inherited prototype properties. This can lead to the disclosure of sensitive information like API keys or internal tokens in multi-tenant environments. The issue is fixed in version 10.25.4 by utilizing the '_getFromScope' helper to enforce property boundaries.
Affected products
- harttle liquidjs < 10.25.4
Timeline
- 2026-04-07: patched: Fix committed and version 10.25.4 released.
- 2026-04-08: disclosed: Security advisory published.