CVE-2026-39859 json
LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read
published 2026-04-08 7 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-20611 , GHSA-v273-448j-v4qj
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, liquidjs 10.25.0 documents root as constraining filenames passed to renderFile() and parseFile(), but top-level file loads do not enforce that boundary. A Liquid instance configured with an empty temporary directory as root can return the contents of arbitrary files. This vulnerability is fixed in 10.25.3.
Patch / fix
- npm liquidjs 10.25.5
- liquidjs liquidjs 10.25.3
- github.com/harttle/liquidjs@f41c1fc commit
- github.com/harttle/liquidjs#870 pull request
- github.com/harttle/liquidjs/releases/tag/v10.25.5 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | liquidjs | <10.25.5 |
10.25.5 |
Affected products
- harttle liquidjs
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/harttle/liquidjs/pull/870
web
-
github.com
/harttle/liquidjs/commit/f41c1fc02fe901598f3328118b42b13bc6bc9b04
web
-
github.com
/harttle/liquidjs/security/advisories/GHSA-v273-448j-v4qj
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-39859
advisory
-
github.com
/harttle/liquidjs
package
-
github.com
/harttle/liquidjs/releases/tag/v10.25.5
web
Sources
- CVE List CVE-2026-39859
- GitHub Advisory GHSA-v273-448j-v4qj
- NVD CVE-2026-39859
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.