LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 26, 2026 · NIST NVD

   Detected

   LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, LiquidJS's security mechanism can be completely bypassed by using reverse range expressions (e.g., ), allowing an attacker to allocate unlimited memory. Combined with a string flattening operation (e.g., filter), this causes a V8 Fatal error that crashes the Node.js process, resulting in c

2. Jun 17, 2026 · NIST NVD

   Updated

   LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, LiquidJS's security mechanism can be completely bypassed by using reverse range expressions (e.g., ), allowing an attacker to allocate unlimited memory. Combined with a string flattening operation (e.g., filter), this causes a V8 Fatal error that crashes the Node.js process, resulting in c

Affected

• cpe liquidjs/liquidjsversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-33285

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-33285

  LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, LiquidJS's security mechanism can be completely bypassed by using reverse range expressions (e.g., ), allowing an attacker to allocate unlim

  nvd.nist.gov

References

• Patch · github.com
• Exploit · github.com