p PatchFirst

CVE-2026-45618

CVE-2026-45618 · LiquidJS is Vulnerable to Remote Code Execution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.

CVSS 10.0 · Critical · EPSS 0.8% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • liquidjs

    Versions
    • < 10.26.0: Affected

    No fix published

  • liquidjs npm

    Affected ranges
    • SEMVER: < 10.26.0

    Update to 10.26.0

Original sources

Check your server →