External risk intelligence

LiquidJS Arbitrary Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-45618

LiquidJS is a template engine library used within applications to process templates. While it can be integrated into internet-facing web applications to render dynamic content, it is a developer-focused library rather than a standalone edge service, gateway, or pre-configured web server, making direct public exposure dependent on how it is implemented by the end-user.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in LiquidJS, a template engine used for rendering content, which could allow attackers to execute arbitrary code by submitting specially crafted templates. This issue has been addressed in version 10.26.0.

Arbitrary code can be run with malicious templates.
Executive oversight is needed for potential exposure.
Confirm if this technology is used in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could potentially execute arbitrary code by submitting specially crafted templates to applications that use a vulnerable version of the LiquidJS template engine. This could occur without any authentication or user interaction, as the template engine processes these inputs. If successful, the vulnerability could lead to the execution of malicious code with significant impact on the affected system.

No authentication or user interaction needed.
Triggered by crafted templates.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, crafted LiquidJS templates could lead to arbitrary code execution. This may impact the integrity and availability of services that render these templates, and potentially expose sensitive information processed by the application.

Arbitrary code execution in template engine.
Crafted templates trigger code execution.
Service integrity and availability risks.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability, as LiquidJS is a template engine library integrated into applications. The immediate first step is to identify all instances where LiquidJS is used, confirm exposure and criticality, and then assign ownership for remediation.

Application owners should own the issue.
Verify template engine reachability and business impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is LiquidJS?

LiquidJS is a JavaScript library that functions as a template engine. Developers use it to render dynamic content by processing templates, often to maintain compatibility with Shopify or GitHub Pages workflows. Because it is a library rather than a standalone server, it is typically embedded into larger web applications to handle the logic that transforms raw data into user-facing web pages.

How does CVE-2026-45618 cause code execution?

This vulnerability falls under the weakness class of Improper Control of Generation of Code, or CWE-94. It occurs because the template engine fails to properly sanitize input, allowing it to treat certain malicious template strings as executable instructions. Instead of merely displaying text, the system interprets the crafted template as commands, granting an attacker the ability to run arbitrary code on the underlying host.

Do I need to interact with the system to trigger this bug?

No. The vulnerability does not require any authentication or user interaction to be triggered. An attacker simply needs to submit a specially crafted template to the application. Note that harmless, standard templates that do not contain the specific malformed structures required to exploit this flaw will not trigger the vulnerability; only inputs designed to abuse the template parsing logic present the risk.

Why is this CVE relevant to my infrastructure?

Its relevance depends on how you have integrated the library. According to Halo Surface Signal, because LiquidJS is a developer-focused library, its risk is tied to your specific implementation. If your application processes user-submitted templates and is internet-facing, the risk of external exploitation is higher. If the engine is used only in internal, non-exposed tools, the likelihood of an attacker reaching the vulnerable code path is significantly lower.

When should I update LiquidJS?

You should prioritize updating to version 10.26.0 immediately after identifying all instances of the library within your codebase. Since this is a library-level update, simply knowing your server versions is insufficient; you must audit your project dependencies. Once you locate the affected components, coordinate with your development teams to apply the patch and verify that the new version handles template parsing securely.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.