CVE-2026-61556

Received Received - Intake

Infinite Loop in LiquidJS strip_html Filter

Publication date: 2026-08-19

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In strip_html, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a<. This issue is fixed in version 10.27.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-25

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-61556

EUVD

EUVD-2026-63089

Affected Vendors & Products

Vendor	Product	Version / Range
liquidjs	liquidjs	From 10.26.0 (inc) to 10.27.1 (exc)
liquidjs	liquidjs	10.27.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability is in LiquidJS, a JavaScript template engine. The strip_html filter can enter an infinite loop when processing strings containing '<' followed by a character and no '>'. This causes the template rendering to hang, leading to a denial of service with minimal input like 'a<'. It was fixed in version 10.27.1.

Detection Guidance

This vulnerability affects LiquidJS versions between 10.26.0 and 10.27.1. To detect it, check the installed version of LiquidJS in your project using commands like 'npm list liquidjs' or 'grep liquidjs package.json'. If the version is within the vulnerable range, the system is potentially affected.

Impact Analysis

This vulnerability can cause denial of service by freezing template rendering with a short input string. If your application uses LiquidJS versions between 10.26.0 and 10.27.1, an attacker could exploit this to disrupt service.

Compliance Impact

This vulnerability causes a denial of service by entering an infinite loop during template rendering, which could disrupt system availability. For GDPR, this may impact data processing operations requiring timely access. For HIPAA, it could affect system responsiveness critical for healthcare operations. However, direct compliance impact depends on system usage and mitigation.

Mitigation Strategies

Upgrade LiquidJS to version 10.27.1 or later immediately. Use commands like 'npm update liquidjs' or modify package.json to specify the fixed version. If upgrading is not possible, consider removing or replacing the strip_html filter in templates to prevent the infinite loop.

Hi! I’m here to help you understand CVE-2026-61556. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70