{"answers":{"affected":"2 open source packages ship an affected version, including liquidjs.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61556 exists.","fix":"Upgrade liquidjs to 10.27.1 or later.","what":"CVE-2026-61556 is a high-severity denial of service vulnerability in harttle liquidjs, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-61556 and fix it if it is affected.\n\nWhat it is: CVE-2026-61556 is a high-severity denial of service vulnerability in harttle liquidjs, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61556 exists.\n\nAffected packages and fixed versions:\n- liquidjs (npm): affected from 10.26.0; fixed in 10.27.1\n- liquidjs (npm): affected from 10.26.0; fixed in 10.27.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-61556/ (Markdown: https://insights.sbomify.com/CVE-2026-61556/index.md)","id":"CVE-2026-61556","markdown":"https://insights.sbomify.com/CVE-2026-61556/index.md","name":"CVE-2026-61556","record":{"aliases":["GHSA-m7fp-h3p4-hr49","MINI-3xp4-pcq3-xvwq","MINI-mc2w-mq8f-9cr8","MINI-ppq2-p7fg-39c2"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"JavaScript template engine","requires_auth":"none","summary":"An attacker can cause a denial of service in LiquidJS by providing a specific malformed HTML string to the strip_html filter, leading to an infinite loop.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-835","name":"Loop with Unreachable Exit Condition"}],"description":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains \u003c, includes at least one preceding character, and has no later \u003e. In strip_html, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a\u003c. This issue is fixed in version 10.27.1.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"LiquidJS: An infinite loop vulnerability in `strip_html` filter","id":"CVE-2026-61556","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":2,"n_references":4,"next":{"headline":"@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery","id":"CVE-2026-61559"},"packages":[{"ecosystem":"npm","fixed":["10.27.1"],"introduced":["10.26.0"],"last_affected":[],"package":"liquidjs","purl":null,"source":"GHSA-m7fp-h3p4-hr49"},{"ecosystem":"npm","fixed":["10.27.1"],"introduced":["10.26.0"],"last_affected":[],"package":"liquidjs","purl":"pkg:npm/liquidjs","source":"GHSA-m7fp-h3p4-hr49"}],"prev":{"headline":"OpenEXR: Empty multiView viewFromChannelName file crash","id":"CVE-2026-61555"},"products":["liquidjs"],"published":"2026-08-19","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-25","vendors":["harttle"]},"summary":"An attacker can cause a denial of service in LiquidJS by providing a specific malformed HTML string to the strip_html filter, leading to an infinite loop.","url":"https://insights.sbomify.com/CVE-2026-61556/"}