Executive brief
LiquidJS is a template engine used to generate dynamic web content, similar to those used by Shopify and GitHub Pages. A flaw in how it handles date formatting allows an attacker to provide a specially crafted date format that forces the server to consume massive amounts of memory and processing power. This can lead to the application crashing or becoming unresponsive, bypassing built-in safety limits designed to prevent such resource exhaustion attacks.
Technical details
A vulnerability exists in LiquidJS versions 10.25.7 and below due to improper validation of width specifiers in the 'date' filter's strftime implementation. The regex-based parser captures width specifiers (e.g., %9999999d) and passes them unchecked to an internal padding function. This function performs unbounded string concatenation in a loop without consulting the engine's 'memoryLimit' or 'renderLimit' configurations. An attacker who can influence the date format string—a common pattern in applications allowing user-defined templates or profile-based date settings—can trigger multi-megabyte allocations and excessive CPU cycles, leading to process crashes (OOM). The issue is fixed in version 10.26.0 by capping widths and enforcing memory accounting.
Affected products
- harttle liquidjs <= 10.25.7
Timeline
- 2026-05-10: patched: Fix committed to repository
- 2026-05-14: advisory: Version 10.26.0 released
- 2026-06-17: disclosed: CVE published