CVE-2026-39412 json
LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
published 2026-04-08 7 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-20600 , GHSA-rv5g-f82m-qrvv
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.4, the sort_natural filter bypasses the ownPropertyOnly security option, allowing template authors to extract values of prototype-inherited properties through a sorting side-channel attack. Applications relying on ownPropertyOnly: true as a security boundary (e.g., multi-tenant template systems) are exposed to information disclosure of sensitive prototype properties such as API keys and tokens. This vulnerability is fixed in 10.25.4.
Patch / fix
- npm liquidjs 10.25.4
- liquidjs liquidjs 10.25.4
- github.com/harttle/liquidjs@e743da0 commit
- github.com/harttle/liquidjs#869 pull request
- github.com/harttle/liquidjs/releases/tag/v10.25.4 release
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | liquidjs | <10.25.4 |
10.25.4 |
Affected products
- harttle liquidjs
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/harttle/liquidjs/pull/869
web, issue-tracking, product
-
github.com
/harttle/liquidjs/commit/e743da0020d34e2ee547e1cc1a86b58377ebe1ce
web, patch
-
github.com
/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv
exploit, web, vendor-advisory
-
github.com
/harttle/liquidjs/releases/tag/v10.25.4
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-39412
advisory
-
github.com
/harttle/liquidjs
package
Sources
- CVE List CVE-2026-39412
- GitHub Advisory GHSA-rv5g-f82m-qrvv
- NVD CVE-2026-39412
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.