Executive brief
LiquidJS is a popular JavaScript template engine that processes dynamic content. Its strip_html filter is designed to remove HTML tags from text. A flaw in this filter causes it to enter an infinite loop when processing certain malformed HTML, consuming 100% of CPU and making the application unresponsive. An attacker can trigger this with minimal input, causing denial of service to any application relying on this library.
Technical details
The vulnerability is a loop-with-unreachable-exit-condition (CWE-835) in the strip_html function in src/filters/html.ts. The function iterates through a string looking for '<' characters and attempts to match them with closing '>' characters by checking against a Map of HTML block patterns. When a '<' is found but no closing '>' exists (and the pattern doesn't match any known openers like '<script' or '<style'), the code fails to advance the loop counter 'i', causing it to re-examine the same position indefinitely. The vulnerable condition 'if (i === lt) return...' should be 'if (i <= lt) return...' to handle cases where i never updates. This affects LiquidJS versions >= 10.26.0 and < 10.27.1. The vulnerability is remotely triggerable via any template input processed by the filter.
Affected products
- harttle liquidjs >= 10.26.0, < 10.27.1
Timeline
- 2026-08-17: disclosed: GitHub advisory published
- 2026-08-19: advisory: CVE-2026-61556 published in National Vulnerability Database
- 2026-09-03: patched: Version 10.27.1 released with fix changing equality check to less-than-or-equal
References
- https://api.github.com/users/NariyoshiChida
- https://github.com/NariyoshiChida
- https://api.github.com/users/NariyoshiChida/gists%7B/gist_id%7D
- https://api.github.com/users/NariyoshiChida/repos
- https://avatars.githubusercontent.com/u/11674670?v=4
- https://api.github.com/users/NariyoshiChida/events%7B/privacy%7D