CVE-2026-45618

Received Received - Intake

Code Execution Vulnerability in LiquidJS Template Engine

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-45618

EUVD

EUVD-2026-56922

Affected Vendors & Products

Vendor	Product	Version / Range
harttle	liquidjs	to 10.26.0 (exc)
harttle	liquidjs	10.26.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-45618 is a critical Remote Code Execution (RCE) vulnerability in the LiquidJS npm package affecting versions 10.25.7 and earlier. Attackers can execute arbitrary code by crafting malicious Liquid templates through prototype pollution and gadget chain attacks, manipulating object properties and using JavaScript's Function constructor.

Detection Guidance

Check if your system uses LiquidJS versions 10.25.7 or earlier by running: npm list liquidjs. If the version is vulnerable, update to v10.26.0 or later immediately.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on systems using vulnerable LiquidJS versions without requiring privileges, user interaction, or local access. It can lead to full system compromise, data theft, or service disruption due to its network-based attack vector and maximum CVSS severity score.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A successful exploit may violate these regulations by enabling data breaches or unauthorized access.

Mitigation Strategies

Upgrade LiquidJS to version 10.26.0 or later using: npm update liquidjs. If upgrading is not possible, consider removing LiquidJS from your project until a patch is applied.

Hi! I’m here to help you understand CVE-2026-45618. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70