CVE-2026-39412 Details
Description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.4, the sort_natural filter bypasses the ownPropertyOnly security option, allowing template authors to extract values of prototype-inherited properties through a sorting side-channel attack. Applications relying on ownPropertyOnly: true as a security boundary (e.g., multi-tenant template systems) are exposed to information disclosure of sensitive prototype properties such as API keys and tokens. This vulnerability is fixed in 10.25.4.
A vulnerability in LiquidJS versions prior to 10.25.4 allows the sort_natural filter to bypass the ownPropertyOnly security option. This flaw enables template authors to access values of prototype-inherited properties through a sorting side-channel attack. Applications that depend on ownPropertyOnly: true as a security measure, such as multi-tenant template systems, risk disclosing sensitive prototype properties like API keys and tokens. The issue arises because the sort_natural and sort filters directly access object properties via bracket notation, which traverses the prototype chain, instead of using a method that respects the ownPropertyOnly option.
Users should update to LiquidJS version 10.25.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv | CISA-ADP | ExploitVendor Advisory |
| https://github.com/harttle/liquidjs/commit/e743da0020d34e2ee547e1cc1a86b58377ebe1ce | [email protected] | Patch |
| https://github.com/harttle/liquidjs/pull/869 | [email protected] | Issue TrackingProduct |
| https://github.com/harttle/liquidjs/releases/tag/v10.25.4 | [email protected] | Release Notes |
| https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| liquidjs liquidjs | < 10.25.4 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | CVE Modified | CISA-ADP |
| Apr 8, 2026 | New CVE Received | [email protected] |