CVE-2026-55575
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
CVSS Score
0.0
EPSS Score
0.4%
EPSS Percentile
30th
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filter at src/filters/array.ts allocated a full clone of its input array via [...toArray(v)] without calling this.context.memoryLimit.use(...), allowing a template render such as {{ huge_array | pop }} to allocate an O(N) clone of an attacker-influenced array outside the configured memoryLimit budget. This issue is fixed in version 10.27.1.
| CWE | CWE-770 |
| Vendor | harttle |
| Product | liquidjs |
| Published | Jul 8, 2026 |
| Last Updated | Jul 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for harttle liquidjs
Be the first to know when new unknown vulnerabilities affecting harttle liquidjs are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
harttle / liquidjs
< 10.27.1
References
github.com: https://github.com/harttle/liquidjs/security/advisories/GHSA-g357-x5c3-c72p github.com: https://github.com/harttle/liquidjs/pull/907 github.com: https://github.com/harttle/liquidjs/commit/8a0c74a7fcb1671aa1dcb71ec82ba0602dc90d04 github.com: https://github.com/harttle/liquidjs/releases/tag/v10.27.1