LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, liquidjs 10.25.0 documents root as constraining filenames passed to renderFile() and parseFile(), but top-level file loads do not enforce that boundary. A Liquid instance configured with an empty temporary directory as root can return the contents of arbitrary files. This vulnerability is fixed in 10.25.3.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-v273-448j-v4qj | LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 08 Apr 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, liquidjs 10.25.0 documents root as constraining filenames passed to renderFile() and parseFile(), but top-level file loads do not enforce that boundary. A Liquid instance configured with an empty temporary directory as root can return the contents of arbitrary files. This vulnerability is fixed in 10.25.3. | |
| Title | LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read | |
| Weaknesses | CWE-22 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-04-08T19:45:21.747Z
Reserved: 2026-04-07T19:13:20.379Z
Link: CVE-2026-39859
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-04-08T20:16:26.273
Modified: 2026-04-08T21:26:13.410
Link: CVE-2026-39859
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses