# CVE-2026-45618: LiquidJS remote code execution via crafted templates

Source: https://junglewise.ai/threats/cve-2026-45618-liquidjs-remote-code-execution-via-crafted-templates  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-45618 · Severity: critical · CVSS 10 · Published 2026-08-11

LiquidJS, a popular template engine for Node.js, is vulnerable to a critical security flaw that allows attackers to execute arbitrary code on the server. By providing a specially crafted template, an attacker can bypass security boundaries to take full control of the underlying system, potentially leading to data theft, service disruption, or further network compromise. Organizations using LiquidJS to render user-provided content should update to version 10.26.0 or later immediately.

Technologies: [liquidjs (npm)](https://junglewise.ai/threats/technologies/liquidjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-45618 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45618 being exploited in the wild.

**How severe is CVE-2026-45618?** Critical severity, with a CVSS score of 10, published 11 August 2026.

**Which products and versions are affected?** liquidjs (npm) < 10.26.0, SEMVER:introduced=0,fixed=10.26.0.

**Is there a fix for CVE-2026-45618?** Yes. liquidjs (npm): upgrade to 10.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45618 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45618?** Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- liquidjs (npm): upgrade to 10.26.0 or later

  ```sh
  npm install liquidjs@10.26.0
  ```


## Technical details

LiquidJS is vulnerable to Remote Code Execution (RCE) due to improper isolation during template evaluation. An attacker can use the `valueOf` filter to obtain a reference to the internal `this` context (the scope). By leveraging 'comparable' gadgets and prototype pollution techniques within the template, an attacker can overwrite internal properties such as `this.loader.lookup` and `this.readFile`. This allows the attacker to manipulate the `_parseFile` generator to obtain a reference to the `Function` constructor, enabling the execution of arbitrary JavaScript code. The vulnerability is patched in version 10.26.0.

## Affected products

- harttle liquidjs < 10.26.0

## Identifiers

- CVE-2026-45618
- GHSA-gf2q-c269-pqgc

## Timeline

- 2026-05-24: disclosed
- 2026-05-27: advisory

## References

- [https://api.github.com/users/c0rydoras](https://api.github.com/users/c0rydoras)
- [https://github.com/c0rydoras](https://github.com/c0rydoras)
- [https://api.github.com/users/c0rydoras/gists%7B/gist_id%7D](https://api.github.com/users/c0rydoras/gists%7B/gist_id%7D)
- [https://api.github.com/users/c0rydoras/repos](https://api.github.com/users/c0rydoras/repos)
- [https://avatars.githubusercontent.com/u/110528300?v=4](https://avatars.githubusercontent.com/u/110528300?v=4)
- [https://api.github.com/users/c0rydoras/events%7B/privacy%7D](https://api.github.com/users/c0rydoras/events%7B/privacy%7D)

## Related threats

- [LiquidJS ownPropertyOnly bypass via inherited array indices](https://junglewise.ai/threats/cve-2026-106120-liquidjs-is-a-shopify-github-pages-compatible-template-engine-in)
- [LiquidJS join filter uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-69222-liquidjs-uncontrolled-resource-consumption-in-join-filter)
- [LiquidJS infinite loop in strip_html filter](https://junglewise.ai/threats/cve-2026-61556-liquidjs-infinite-loop-in-strip-html-filter)
- [LiquidJS memory limit bypass in pop array filter](https://junglewise.ai/threats/cve-2026-55575-liquidjs-memory-limit-bypass-in-pop-array-filter)
- [LiquidJS ReDoS in strip_html filter](https://junglewise.ai/threats/cve-2026-45617-liquidjs-redos-in-strip-html-filter)