CyberRota Analysis
AI-GeneratedThe vulnerability affects the LiquidJS template engine used in JavaScript applications, specifically versions 10.26.0 to 10.27.1, where the strip_html filter can enter an infinite loop under certain input conditions, leading to denial of service. This flaw can block template rendering, making it critical for developers using LiquidJS in their applications to prioritize updating to version 10.27.1 or later to mitigate the risk. Organizations leveraging Java or GitHub Pages should assess their use of LiquidJS and apply the necessary updates to avoid potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In strip_html, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a<. This issue is fixed in version 10.27.1.