Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-30952 liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access… https://www.cve.org/CVERecord?id=CVE-2026-30952
Post summary
CVE-2026-30952 exposes liquidjs templates to arbitrary file access via layout, render, and include tags in versions older than 10.25.0.
🔴 LiquidJS, Path Traversal, #CVE-2026-30952 (High) https://dailycve.com/liquidjs-path-traversal-cve-2026-30952-high/
Post summary
The post announces the LiquidJS Path Traversal vulnerability CVE‑2026‑30952, highlighting its high severity and linking to a DailyCVE article for further details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | liquidjs | liquidjs | - | node.js | - |