GitHub LiquidJS & GitPython: Three High-Severity Flaws Disclosed Together
GitHub's LiquidJS and GitPython libraries were impacted by three high-severity vulnerabilities disclosed on August 19, 2026, patched in recent updates.
Key findings
- Three high-severity vulnerabilities disclosed together on August 19, 2026, affect GitHub's LiquidJS and GitPython libraries.
- LiquidJS issues include an incorrect complexity calculation in the 'join' filter and an infinite loop in 'strip_html'.
- GitPython's CVE-2026-76219 allows arbitrary file overwrite due to improper handling of treeish strings.
- All vulnerabilities are patched in LiquidJS 10.27.2 and GitPython 3.1.58.
On August 19, 2026, a batch of three high-severity vulnerabilities was disclosed for GitHub's LiquidJS and GitPython libraries, with publication times spanning a 7-hour window. These vulnerabilities, affecting LiquidJS versions prior to 10.27.2 and GitPython versions before 3.1.58, highlight potential risks for developers using these tools in their projects.
The LiquidJS template engine, a component used in Shopify and GitHub Pages, is impacted by two distinct issues. CVE-2026-69222, a flaw in the join filter, incorrectly calculates complexity based on array length rather than the resulting string length, potentially leading to performance issues or denial-of-service conditions. The second LiquidJS vulnerability, CVE-2026-61556, resides in the strip_html filter. This filter can enter an infinite loop when processing strings containing '<' without a subsequent '>', posing a risk of resource exhaustion.
The third vulnerability, CVE-2026-76219, affects the GitPython library. This arbitrary file overwrite flaw stems from improper validation and argument separation when handling treeish strings in methods like IndexFile.from_tree. Attackers could exploit this by injecting options such as --index-output, potentially leading to the overwriting of critical files on the system. This particular vulnerability was also noted in a broader disclosure by Vypr Intelligence, which detailed six vulnerabilities in GitPython.
While the provided information does not specify active exploitation of these particular CVEs, the high severity ratings (CVSSv3 scores up to 8.1) indicate a significant potential impact. The GitPython advisory mentioned that attackers could inject options to achieve arbitrary file overwrite, suggesting a clear attack vector.
GitHub has addressed these vulnerabilities through updates. LiquidJS has been patched in version 10.27.2, and GitPython in version 3.1.58. Users of these libraries are strongly advised to update to the patched versions to mitigate the identified risks. The coordinated disclosure on August 19, 2026, allowed for timely patching and awareness within the developer community.
The simultaneous disclosure of these vulnerabilities underscores the importance of regular security audits for widely used developer tools. Developers integrating LiquidJS or GitPython into their workflows should ensure they are using the latest secure versions to protect their applications and systems from potential compromise. The nature of these flaws—ranging from infinite loops to arbitrary file overwrites—highlights the diverse security challenges present in code parsing and file manipulation libraries.