Περιγραφή
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, liquidjs 10.25.0 documents root as constraining filenames passed to renderFile() and parseFile(), but top-level file loads do not enforce that boundary. A Liquid instance configured with an empty temporary directory as root can return the contents of arbitrary files. This vulnerability is fixed in 10.25.3.
CVSS 7.5EPSS 0.447%Κίνδυνος 0.78
Προβολή πηγής- Δημοσίευση
- 2026-04-08 20:16:26
- Επηρεαζόμενες εκδόσεις
- <10.25.3
- Τύπος
- Package
- Τελευταία τροποποίηση
- 2026-07-24 21:10:00
- Διάνυσμα
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N