CVE-2022-25948 Information Exposure
Attackers can leak prototype properties when the ownPropertyOnly parameter is disabled, exposing internal object data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25948?
CVE-2022-25948 is a medium-severity vulnerability in liquidjs, published on 23 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided.
Weakness: CWE-200
Which versions are affected by CVE-2022-25948?
2 open source packages ship an affected version, including liquidjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
liquidjs npm | All versions | 10.0.0 |
liquidjs npm | All versions | 10.0.0 |
Products include Liquidjs Liquidjs.
How do I fix CVE-2022-25948?
Upgrade liquidjs to 10.0.0 or later.
Is CVE-2022-25948 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-25948 exists.
Other vulnerabilities in liquidjs
- CVE-2026-30952 liquidjs has a path traversal fallback vulnerability
- CVE-2026-35525 LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates
- CVE-2026-41311 LiquidJS is vulnerable to Denial of Service via circular block reference in layout
- CVE-2026-33285 LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
- CVE-2026-33287 LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
Sources
Also known as GHSA-45rm-2893-5f49.