CVE-2026-30952 json
liquidjs has a path traversal fallback vulnerability
published 2026-03-10 8 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-10872 , GHSA-wmfp-5q7x-987x
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0.
Patch / fix
- npm liquidjs 10.25.0
- liquidjs liquidjs 10.25.0
- github.com/harttle/liquidjs@3cd024d commit
- github.com/harttle/liquidjs#851 pull request
- github.com/harttle/liquidjs#855 pull request
- github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x advisory
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | liquidjs | <10.25.0 |
10.25.0 |
Affected products
- harttle liquidjs
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/harttle/liquidjs/pull/851
web, issue-tracking, patch
-
github.com
/harttle/liquidjs/pull/855
web, issue-tracking, patch
-
github.com
/harttle/liquidjs/commit/3cd024d652dc883c46307581e979fe32302adbac
web, patch
-
github.com
/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x
web, mitigation, patch, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-30952
advisory
-
github.com
/harttle/liquidjs
package
Sources
- CVE List CVE-2026-30952
- GitHub Advisory GHSA-wmfp-5q7x-987x
- NVD CVE-2026-30952
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.