SCA: security update for liquidjs (GHSA-fwxr-j5w2-587m)

medium Tenable Self-Hosted Container Security Plugin ID 473681

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2,
enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing,
.first, .last, the first filter, the last filter, join, reverse, slice, compact, and for-loop iteration
can read prototype-provided elements outside readJSProperty(). An attacker who can influence prototype
state or inherited array-index data and cause templates to render affected operations can disclose values
that ownPropertyOnly is expected to hide. Direct positive indexing and ordinary object prototype reads are
blocked, but the alternate array paths remain affected. This issue is fixed in 10.27.2. (CVE-2026-106120)

Solution

Update the liquidjs library and its related packages to version 10.27.2 or later.

Plugin Details

Severity: Medium

ID: 473681

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/7/2026

Updated: 10/7/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.67

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-106120

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6

Threat Score: 2.3

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/7/2026

Vulnerability Publication Date: 10/6/2026

Reference Information

CVE: CVE-2026-106120

cwe: CWE-200

Detections

Analytics