PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-61556 harttle CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T21:17:03.633Z and has not been modified since then. The NVD entry is currently 8.7 HIGH. LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In strip_html, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a<. This issue is fixed in version 10.27.1. Developers and administrators using LiquidJS template engine versions 10.26.0 to 10.27.1 should prioritize patching due to the high-severity denial of service vulnerability. Operators, platform administrators, vulnerability management teams, and security teams should review affected scope, plan updates or mitigations, and monitor for potential denial of service attempts. The CVE Program record and NIST NVD detail page confirm a denial of service vulnerability in LiquidJS template engine versions 10.26.0 to 10.27.1, patched in version 10.27.1. Evidence is limited to official sources and patch release information. Defenders should verify affected deployments, review official advisories, and plan updates or mitigations.

Vendor
harttle
Product
liquidjs
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-19
Original CVE updated
2026-08-25
Advisory published
2026-08-19
Advisory updated
2026-08-25

Who should care

Developers and administrators using LiquidJS template engine versions 10.26.0 to 10.27.1 should prioritize patching due to the high-severity denial of service vulnerability. Operators, platform administrators, vulnerability management teams, and security teams should review affected scope, plan updates or mitigations, and monitor for potential denial of service attempts.

Technical summary

The strip_html filter in LiquidJS template engine versions 10.26.0 to 10.27.1 can enter an infinite loop, causing denial of service. This occurs when an input string contains <, includes at least one preceding character, and has no later >. The issue is patched in version 10.27.1, which corrects the loop stall condition. Affected deployments should prioritize patching due to the high-severity impact.

Defensive priority

Denial of service vulnerability in LiquidJS template engine, prioritize patching for high-severity impact.

Recommended defensive actions

  • Patch LiquidJS to version 10.27.1 or later
  • Inventory and update affected installations
  • Monitor for potential denial of service attempts
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE Program record and NIST NVD detail page confirm a denial of service vulnerability in LiquidJS template engine versions 10.26.0 to 10.27.1, patched in version 10.27.1. Evidence is limited to official sources and patch release information. Defenders should verify affected deployments, review official advisories, and plan updates or mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-61556 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-61556

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-61556 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-61556

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.