CVE-2026-61556

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61556
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61556.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61556
Aliases
  • GHSA-m7fp-h3p4-hr49
Published
2026-08-19T20:49:56.020Z
Modified
2026-08-21T03:46:54.043286113Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
LiquidJS: An infinite loop vulnerability in `strip_html` filter
Details

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the striphtml filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In striphtml, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a<. This issue is fixed in version 10.27.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-835"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61556.json"
}
References

Affected packages

Git / github.com/harttle/liquidjs

Affected ranges

Type
GIT
Repo
https://github.com/harttle/liquidjs
Events
Introduced
c20c0af02d33e8d2ca6b08925eadca8755257c39
Fixed
5c3522f33928aae66f0fe85c36e1d9015c768fe2
Fixed
ed489865b64ce8f7cae2f14875e1a05742e043b3
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "10.26.0"
        },
        {
            "fixed": "10.27.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v10.*
v10.26.0
v10.27.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61556.json"