Executive brief
LiquidJS is a template engine used to generate dynamic content, often in multi-tenant environments like email marketing or website builders. A flaw in its resource management allows a user to bypass time-based safety limits by submitting a specially crafted template with an empty loop. This can cause the server to freeze for several seconds, leading to a denial-of-service condition where the application becomes unresponsive to other users.
Technical details
A vulnerability in LiquidJS versions 10.25.7 and below allows for uncontrolled resource consumption (CWE-400). The 'renderLimit' option, intended to bound the execution time of template rendering, is only checked within the loop that processes template nodes. By providing a '{% for %}' or '{% tablerow %}' tag with an empty body, an attacker can force the engine to iterate through a large collection without ever triggering the time-limit check. This bypasses the wall-clock budget and allows a single render call to monopolize the Node.js event loop for an attacker-controlled duration, scaling linearly with the size of the collection. The issue is fixed in version 10.26.0 by moving the limit check to the entry point of the rendering function.
Affected products
- harttle liquidjs <= 10.25.7
Timeline
- 2026-05-14: patched: Version 10.26.0 released
- 2026-05-24: advisory: GitHub Security Advisory published
- 2026-06-17: disclosed: CVE-2026-44645 published