← Database

CVE-2026-45617

HIGH CVSS: 7.5 Published: 2026-06-17 Modified: 2026-06-22

Description

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in strip_html filter uses a regex containing four flawed lazy-quantified alternatives, leading to ReDoS via quadratic backtracking. When the input contains many

Affected Platforms

Unknown

Weakness Type

CWE-1333

References