Critical severity10.0GHSA Advisory· Published Aug 11, 2026· Updated Aug 13, 2026

CVE-2026-45618

Description

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
liquidjsnpm	< 10.26.0	10.26.0

Affected products

Liquidjs/LiquidjsGHSA
Range: < 10.26.0
osv-coords2 versions
pkg:apk/chainguard/kibana-9.4 pkg:apk/chainguard/kibana-9.4-iamguarded
< 9.4.2-r1+ 1 more
- (no CPE)range: < 9.4.2-r1
- (no CPE)range: < 9.4.2-r1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-gf2q-c269-pqgcghsaADVISORY
github.com/harttle/liquidjs/releases/tag/v10.26.0nvdWEB
github.com/harttle/liquidjs/security/advisories/GHSA-gf2q-c269-pqgcnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.650
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000