CVE-2026-45618

CriticalCVSS 10.0

Published: 11/08/2026(UTC)Updated: 13/08/2026(UTC)Translated: 12/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.85%

55th percentile - higher than 55% of all known CVEs

Summary

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.

Risk Assessment

The risk includes remote code execution in applications using LiquidJS, potentially leading to server compromise or data theft.

Recommendation

It is recommended to update LiquidJS to version 10.26.0 or later and avoid processing untrusted templates.

Original NVD description (English source)

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.