CVE-2026-106120
An attacker who can influence prototype state or inherited array-index data and cause templates to render affected operations can disclose values that ownPropertyOnly is expected to hide.
Does this matter?
Lower severity and a low EPSS score (0.41%). Track it; it rarely justifies an emergency change on its own.
Description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and for-loop iteration can read prototype-provided elements outside readJSProperty(). An attacker who can influence prototype state or inherited array-index data and cause templates to render affected operations can disclose values that ownPropertyOnly is expected to hide. Direct positive indexing and ordinary object prototype reads are blocked, but the alternate array paths remain affected. This issue is fixed in 10.27.2.
- CVSS 4.0
- 6.0 MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.41% probability · 35th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Source
- security-advisories@github.com
EPSS moved from 0.4% on 7 October 2026 to 0.4% on 27 October 2026.
References
- https://github.com/harttle/liquidjs/commit/552819a84b80c62306fe61072628a756272dc749
- https://github.com/harttle/liquidjs/pull/924
- https://github.com/harttle/liquidjs/releases/tag/v10.27.2
- https://github.com/harttle/liquidjs/security/advisories/GHSA-fwxr-j5w2-587m
- https://github.com/harttle/liquidjs/security/advisories/GHSA-fwxr-j5w2-587m
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.