Detections
Analytics

SCA: security update for liquidjs (GHSA-r7g9-xpmj-5fcq)

high Tenable Cloud Security Plugin ID 442392

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions
 10.25.7 and below, the built-in strip_html filter uses a regex containing four flawed lazy-quantified
 alternatives, leading to ReDoS via quadratic backtracking. When the input contains many <script, <style,
 or <!-- opener tokens without matching closers, the V8 regex engine performs O(N²) backtracking, blocking
 the Node.js event loop. A single ~350 KB request ('<script'.repeat(50000)) stalls the process for ~10
 seconds; cost grows quadratically with input size. The default memoryLimit: Infinity does not bound regex
 CPU, and even when configured strip_html only charges str.length to the limit — the regex itself runs
 unbounded. A single unauthenticated request containing crafted untrusted input can cause severe event-loop
 blocking and CPU amplification that saturates Node.js workers while bypassing memoryLimit protections.
 This issue has been fixed in version 10.26.0. (CVE-2026-45617)

Solution

Update the liquidjs library and its related packages to version 10.26.0 or later.

See Also

https://github.com/advisories/GHSA-r7g9-xpmj-5fcq

Plugin Details

Severity: High

ID: 442392

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 5/27/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.24

Vendor

Vendor Severity: High

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-45617

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/27/2026

Vulnerability Publication Date: 5/27/2026

Reference Information

CVE: CVE-2026-45617