CVE-2026-61556 in LiquidJS
Summary
by MITRE • 08/20/2026
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In strip_html, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a<. This issue is fixed in version 10.27.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in LiquidJS, specifically affecting versions from 10.26.0 through 10.27.1, represents a critical logic error within the strip_html filter implementation located in src/filters/html.ts. This template engine is widely deployed in environments such as Shopify and GitHub Pages to render dynamic content by processing user-supplied or system-generated strings containing HTML-like markup. The core function of this filter is to sanitize input by removing HTML tags, a process that typically involves scanning the string for opening angle brackets less than signs and closing greater-than signs to identify tag boundaries. However, under specific conditions involving malformed input, the internal state management logic fails to handle edge cases correctly, leading to an infinite loop condition that halts execution indefinitely.
The technical root cause of this denial-of-service vulnerability lies in the algorithmic handling of string indices during the parsing process. When the filter encounters a less-than character preceded by at least one other character but followed by no corresponding greater-than character within the remainder of the string, it attempts to locate the next opening tag delimiter. The implementation advances an internal pointer labeled lt forward while leaving the primary loop index unchanged when the search for a closing delimiter returns negative one, indicating failure to find a match. Crucially, the stall guard mechanism designed to prevent infinite loops relies on equality checks between indices that do not account for this specific state divergence. Because the loop index remains strictly less than the advanced lt pointer without triggering an exit condition, the processor enters a repetitive cycle of re-evaluating the same invalid state. This results in complete CPU consumption and thread blocking as the engine attempts to resolve a non-existent tag structure indefinitely.
From an operational perspective, this flaw allows for a remote denial-of-service attack with minimal resource requirements from the attacker's side. The malicious payload required to trigger this condition is exceptionally small; even a string consisting of only two characters such as less-than followed by any other character can initiate the infinite loop. For applications relying on LiquidJS to process user input, template data, or configuration files containing untrusted HTML fragments, an attacker could exploit this behavior to exhaust server resources, degrade service availability for legitimate users, and potentially cause cascading failures in dependent systems that expect timely response times from the templating engine. This aligns with CWE-835, which describes logic errors leading to infinite loops, and maps to MITRE ATT&CK technique T1496, representing Resource Hijacking where an attacker consumes computational resources to disrupt service availability.
Mitigation strategies primarily involve upgrading the LiquidJS dependency to version 10.27.1 or later, where this specific logical flaw has been resolved by correcting the index management and stall guard logic within the strip_html filter. For organizations unable to immediately patch their dependencies, implementing input validation at the application layer can serve as a compensating control. This includes sanitizing inputs before they reach the template engine, ensuring that malformed HTML structures are either corrected or rejected prior to processing. Additionally, deploying runtime protection mechanisms such as timeout limits on long-running processes or resource monitoring alerts can help detect and terminate hung threads caused by this vulnerability, thereby preserving service continuity until a permanent code fix is applied across all affected instances of the software stack.