CVE-2026-45618 in LiquidJS
Summary
by MITRE • 08/11/2026
LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in LiquidJS represents a critical remote code execution flaw that emerged due to insufficient input validation within the template engine's processing pipeline. This issue affected versions prior to 10.26.0 and allowed attackers to inject malicious code through specially crafted templates, potentially compromising systems that utilize this template engine for content rendering. The vulnerability stems from the engine's failure to properly sanitize template inputs, creating a dangerous pathway for arbitrary code execution.
The technical exploitation of this vulnerability occurs when LiquidJS processes templates containing malicious code within its template syntax. Attackers can leverage specific template constructs that bypass normal validation mechanisms, allowing them to execute arbitrary commands on the system where the template engine operates. This flaw particularly affects environments where user-supplied templates are processed, such as Shopify stores or GitHub Pages deployments that utilize LiquidJS for dynamic content generation. The vulnerability aligns with CWE-94, which classifies improper control of generation of code, and represents a classic example of code injection attacks.
The operational impact of this vulnerability extends beyond simple template rendering, as it can lead to complete system compromise when exploited. Organizations using LiquidJS in production environments face significant risks including data breaches, unauthorized access to sensitive information, and potential lateral movement within their infrastructure. The attack surface is particularly wide given that LiquidJS is used by major platforms like Shopify and GitHub Pages, meaning that exploitation could affect thousands of applications simultaneously. This vulnerability demonstrates the critical importance of validating all user inputs in template engines, especially those handling untrusted content.
Security teams should immediately implement mitigation strategies including updating to version 10.26.0 or later, which contains the necessary patches for this vulnerability. Additional protective measures include implementing strict template validation policies, monitoring for unusual template processing patterns, and establishing network segmentation to limit potential lateral movement. Organizations should also consider implementing web application firewalls and runtime application self-protection mechanisms to detect and prevent exploitation attempts. The remediation process should include comprehensive testing of all affected systems to ensure that the patch effectively addresses the vulnerability without introducing compatibility issues in existing applications. According to ATT&CK framework, this vulnerability maps to T1059.001 (Command and Scripting Interpreter: PowerShell) and T1203 (Exploitation for Client Execution), emphasizing the need for both preventive and detection-focused security controls.