ZeroDay Findings
Sign inSign up

Findings

CVE-2026-30952

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript.

Published Mar 10, 2026 · updated Jun 17, 2026 · liquidjs liquidjs

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 10, 2026 · NIST NVD

    Detected

    liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content o

  2. Jun 17, 2026 · NIST NVD

    Updated

    liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content o

Affected

  • cpe liquidjs/liquidjsversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-30952

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-30952

    liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: tr

    nvd.nist.gov

References