Executive Summary

This vulnerability exists in LiquidJS versions 10.25.7 and below. It involves the Context.spawn() function, which creates a child context for the {% render %} tag but fails to propagate the parent context's resolved ownPropertyOnly value. Instead, the new context derives ownPropertyOnly from the instance-level option, ignoring any override supplied to parseAndRender().

As a result, even if a developer locks down an untrusted render with parseAndRender(..., { ownPropertyOnly: true }), prototype-chain properties can still leak from inside any {% render %} partial. This creates a silent bypass and a distinct exploit surface separate from previously known array-filter related vulnerabilities.

This issue was fixed in version 10.26.0.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to leakage of prototype-chain properties during template rendering with the {% render %} tag, even when protections are intended to be in place. This means sensitive or unintended data from the prototype chain could be exposed in rendered output.

Such leakage could allow attackers or untrusted users to access information they should not have, potentially leading to information disclosure.

The CVSS base score of 5.3 indicates a medium severity impact, with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade LiquidJS to version 10.26.0 or later, where the issue with Context.spawn() and the {% render %} tag has been fixed.

Avoid running Liquid instances with the backwards-compatible ownPropertyOnly:false setting if you rely on untrusted render inputs, as this setting allows prototype-chain property leaks.

Useful 0 Not Useful 0