CVE-2026-45618 – Remote Code Execution (RCE) – LiquidJS < 10.26.0

Summary

CVE-2026-45618 is a critical code injection vulnerability (CWE-94) in LiquidJS, the widely used Node.js implementation of Shopify’s Liquid template language (7.3M+ monthly npm downloads). Versions prior to 10.26.0 allow an unauthenticated, remote attacker to submit a specially crafted Liquid template that escapes the sandboxed filter/tag evaluation logic and reaches Node.js’s Function constructor, resulting in arbitrary code execution on the host. The flaw carries the maximum CVSS v3.1 score of 10.0.

Technical details

• Root cause: The Liquid class constructor initializes its filters and tags registries as plain JavaScript objects rather than null-prototype objects. This means template authors can reference properties inherited from Object.prototype (e.g. valueOf, constructor, toString) as if they were legitimate registered filters/tags.
• Initial leak: A template expression such as 1|valueOf returns a reference to the rendering context (this), exposing internal engine objects such as the loader, filesystem handler, and parser.
• Gadget chain: Attackers can overwrite __proto__ and manipulate comparison filters (equals, gt, geq, lt, leq) so that a subsequent comparison invokes an attacker-chosen function with this bound to the scope object, eventually reaching the Function constructor.
• File-read/parse gadget: By further overwriting loader.lookup and readFile methods (and, per public PoC analysis, targeting Parser._parseFile), the attacker controls the content fed back into the parser, enabling arbitrary JavaScript execution — demonstrated in public proofs-of-concept via child_process.execSync.
• Attack vector: Network-based, no authentication or user interaction required — any application feature that renders attacker-influenced or untrusted content as a Liquid template (CMS themes, email templating, static site generators, Shopify-style storefront customization, etc.) is exploitable.
• Impact: Full compromise of confidentiality, integrity, and availability on the host process running the vulnerable template engine (scope change per the CVSS vector).

Affected software

• liquidjs (npm package, maintained by harttle) — all versions prior to 10.26.0
• Any application, CMS, email templating system, or Node.js service that embeds LiquidJS as a direct or transitive dependency and renders template input that is influenced by untrusted or external sources

Severity

• CVSS v3.1 Base Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Mitigation and recommended actions

• Immediate: Upgrade liquidjs to version 10.26.0 or later, which removes the ability to resolve Object.prototype properties as filters/tags and closes the associated gadget chains.
• If immediate patching is not possible:
  • Do not render Liquid templates that contain any attacker-controlled, user-submitted, or otherwise untrusted content until the fix is applied.
  • Audit all application entry points (theme editors, email builders, CMS content fields, user-supplied templates) that pass external input into LiquidJS’s parseAndRender/render functions, and add strict input validation or disable that functionality temporarily.
  • Isolate template-rendering processes (e.g., via sandboxing, containers with restricted permissions, or separate low-privilege service accounts) to limit blast radius if exploitation occurs.
  • Monitor logs for anomalous Liquid syntax patterns such as valueOf, __proto__, or chained comparison filters in incoming template input.

References

• CVE-2026-45618 at NIST NVD
• GitHub Security Advisory GHSA-gf2q-c269-pqgc
• LiquidJS v10.26.0 Release Notes