CVE-2026-106120 LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration
An attacker can bypass the ownPropertyOnly security setting in LiquidJS to disclose hidden prototype data via specific array operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106120?
CVE-2026-106120 is a medium-severity vulnerability in harttle liquidjs, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and for-loop iteration can read prototype-provided elements outside readJSProperty(). An attacker who can influence prototype state or inherited array-index data and cause templates to render affected operations can disclose values that ownPropertyOnly is expected to hide. Direct positive indexing and ordinary object prototype reads are blocked, but the alternate array paths remain affected. This issue is fixed in 10.27.2.
Weakness: CWE-200
Which versions are affected by CVE-2026-106120?
2 open source packages ship an affected version, including liquidjs.
| Package | Affected | Fixed in |
|---|---|---|
liquidjs npm | All versions | 10.27.2 |
liquidjs npm | All versions | 10.27.2 |
How do I fix CVE-2026-106120?
Upgrade liquidjs to 10.27.2 or later.
Is CVE-2026-106120 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-106120 exists.
Sources
Also known as GHSA-fwxr-j5w2-587m, MINI-3fpc-gq7w-qjrx, MINI-v279-7vmj-qx82, MINI-v4jj-r4c9-ph93.