GHSA-vq2f-vcc9-j8mv

Source

https://github.com/advisories/GHSA-vq2f-vcc9-j8mv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-vq2f-vcc9-j8mv/GHSA-vq2f-vcc9-j8mv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vq2f-vcc9-j8mv

Aliases

Downstream

CGA (2)

ECHO (1)

ECHO-3a95-2e3a-8c10

Published

2026-06-19T20:46:34Z

Modified

2026-09-10T03:51:09Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

Details

Impact

Given a malformed {% case %} tag without associated {% when %} or {% else %} block, and no terminating {% endcase %} tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack.

Patches

The issue is fixed in version 2.2.1 with the correction of the liquid.TokenStream.eof attribute. The kind and value of the special EOF token are now the same, so either can be tested against liquid.token.TOKEN_EOF.

Workarounds

Manually correct the definition of liquid.TokenStream.eof before parsing any templates.

import liquid
from liquid.token import TOKEN_EOF

liquid.stream.TokenStream.eof = liquid.Token(TOKEN_EOF, TOKEN_EOF, -1, "")

# ...

Database specific

{
    "cwe_ids":  [
        "CWE-835"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-19T20:46:34Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / python-liquid

Package

Name: python-liquid; View open source insights on deps.dev
Purl: pkg:pypi/python-liquid

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.2.1

Affected versions

0.*

0.5.1

0.5.2

0.5.3

0.5.5

0.5.6

0.6.0

0.6.1

0.6.2

0.6.3

0.6.4

0.7.0

0.7.1

0.7.2

0.7.3

0.7.4

0.7.5

0.7.6

0.7.7

0.8.0

0.8.1

0.9.0

0.10.0

0.10.1

0.11.0

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.2.0

1.2.1

1.3.0

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.5.0

1.5.1

1.6.0

1.6.1

1.7.0

1.8.0

1.8.1

1.9.0

1.9.1

1.9.2

1.9.3

1.9.4

1.10.0

1.10.2

1.11.0

1.12.0

1.12.1

1.12.2

1.13.0

2.*

2.0.0

2.0.1

2.0.2

2.1.0

2.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-vq2f-vcc9-j8mv/GHSA-vq2f-vcc9-j8mv.json"