Listen to this Post
LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. From version 10.26.0 until 10.27.1, the `strip_html` filter in `src/filters/html.ts` can enter an infinite loop when an input string contains <, has at least one character before <, and no `>` appears after <.
The vulnerability exists in the `strip_html` function, which attempts to strip HTML tags from a string. The function iterates through the input string, searching for `<` characters to identify tag openings. For each `<` found, it checks for a corresponding `>` to close the tag. The issue arises from a logic error in how the loop index (i) and the found position of the next `<` (lt) are managed.
When processing the string “a<", the following occurs:
- The variable `lt` is set to `1` by `str.indexOf(‘<', i)` because the `<` is at index 1.
- The loop then attempts to find a closing `>` for this opening
<. However, since no `>` exists, the `indexOf` call returns-1. - After the inner loop fails to find a match, the code reaches the stall guard:
if (i === lt) return out + str.slice(lt). At this point, `i` is still0, but `lt` is1. Because `0 === 1` is false, the function does not exit. - The `while` loop then continues, starting again with `i` still at
0. This causes the same sequence to repeat indefinitely, leading to an infinite loop.
This is an infinite loop vulnerability (CWE-835). A remote attacker can trigger this denial of service (DoS) with a minimal payload of just two characters, such as “a<“. The issue is fixed in version 10.27.1.DailyCVE Form:
Platform: LiquidJS
Version: 10.26.0 – 10.27.0
Vulnerability: Infinite Loop
Severity: High (CVSS 8.7)
Date: 2026-08-19Prediction: Already Patched (2026-08-19)
What Undercode Say:
Analytics:
– Attack Vector: Network
– Attack Complexity: Low
– Privileges Required: None
– User Interaction: None
– Availability Impact: High
Exploit: (Educational Purposes!)
The following Proof of Concept (PoC) demonstrates the vulnerability:
const { Liquid } = require('liquidjs');
const engine = new Liquid();
engine.parseAndRender('{{ html | strip_html }}', {
html: 'a<'
}).then(console.log);
console.log("This is never displayed.");
Protection:
Upgrade LiquidJS to version 10.27.1 or later. If an immediate upgrade is not possible, implement input validation at the application layer to sanitize or reject malformed HTML structures before they reach the template engine.
Impact:
This vulnerability allows for a remote denial-of-service (DoS) attack. An attacker can send a crafted payload as short as two characters (“a<“) to consume CPU resources and block template rendering indefinitely. This can lead to service degradation or complete unavailability for legitimate users.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
