These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-55575 is a high-severity vulnerability in LiquidJS, a JavaScript template engine. The pop array filter could allocate an O(N) clone of an attacker-influenced array outside the configured memoryLimit budget, potentially leading to memory exhaustion attacks. Developers and administrators using LiquidJS in their applications, especially those with high-traffic or large input data, should prioritize [truncated]
CVE-2026-45357 is a high-severity vulnerability in LiquidJS, a Shopify/GitHub Pages compatible template engine. The vulnerability allows for memory and render limit bypass, potentially leading to large memory allocations, high CPU usage, or OOM crashes per render. This issue was fixed in version 10.26.0. Users of LiquidJS should update to the latest version to mitigate this vulnerability. The vulnerabilit [truncated]
CVE-2026-44646 is a medium-severity vulnerability in LiquidJS, a Shopify/GitHub Pages compatible template engine. The issue allows for a silent bypass of the `ownPropertyOnly` value in the `Context.spawn()` method, which is used in the `{% render %}` tag. This can lead to a leak of prototype-chain properties from inside any `{% render %}` partial. The vulnerability has been fixed in version 10.26.0. Devel [truncated]
CVE-2026-44645 is a MEDIUM severity vulnerability in LiquidJS, a Shopify/GitHub Pages compatible template engine. A crafted template can bypass the renderLimit, potentially causing a denial-of-service (DoS) attack. The vulnerability affects LiquidJS versions 10.25.7 and below, and the renderLimit option can be bypassed by a {% for %} or {% tablerow %} tag with an empty body. This allows a low-privileged t [truncated]
CVE-2026-44644 is a medium severity XSS vulnerability in LiquidJS, a Shopify/GitHub Pages compatible template engine. Versions 10.25.7 and below are vulnerable to XSS through a flaw in the strip_html filter logic. This issue allows attackers to bypass sanitization by placing newlines inside HTML tags, potentially leading to code execution. Developers should review and update their deployments to version 1 [truncated]
CVE-2026-41311 is a denial-of-service vulnerability in LiquidJS. A circular {% layout %}/{% block %} reference can trigger an infinite recursive loop, consuming available memory and crashing the Node.js process. The issue is fixed in LiquidJS 10.25.7, and teams that accept untrusted Liquid templates should prioritize upgrading and adding template validation controls.