# CVE-2026-61556: LiquidJS: An infinite loop vulnerability in `strip_html` filter

> An attacker can cause a denial of service in LiquidJS by providing a specific malformed HTML string to the strip_html filter, leading to an infinite loop.

- **Severity:** High 8.7 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 19 Aug 2026
- **Updated:** 25 Aug 2026
- **Also known as:** GHSA-m7fp-h3p4-hr49, MINI-3xp4-pcq3-xvwq, MINI-mc2w-mq8f-9cr8, MINI-ppq2-p7fg-39c2

## What is CVE-2026-61556?

CVE-2026-61556 is a high-severity denial of service vulnerability in harttle liquidjs, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In strip_html, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a<. This issue is fixed in version 10.27.1.

Weakness: CWE-835 (Loop with Unreachable Exit Condition)

## Which versions are affected by CVE-2026-61556?

2 open source packages ship an affected version, including liquidjs.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `liquidjs` | npm | From 10.26.0 | 10.27.1 |
| `liquidjs` | npm | From 10.26.0 | 10.27.1 |

## How do I fix CVE-2026-61556?

Upgrade liquidjs to 10.27.1 or later.

## Is CVE-2026-61556 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61556 exists.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-61556 and fix it if it is affected.

What it is: CVE-2026-61556 is a high-severity denial of service vulnerability in harttle liquidjs, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61556 exists.

Affected packages and fixed versions:
- liquidjs (npm): affected from 10.26.0; fixed in 10.27.1
- liquidjs (npm): affected from 10.26.0; fixed in 10.27.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-61556/ (Markdown: https://insights.sbomify.com/CVE-2026-61556/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-61556
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-61556
- OSV: https://osv.dev/vulnerability/CVE-2026-61556

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-61556/
Summaries are generated and may contain mistakes; the official description above is the record.