CVE-2022-25948: liquidjs may leak properties of a prototype
Summary
CVE-2022-25948: liquidjs may leak properties of a prototype. Affects liquidjs versions < 10.0.0. Fixed in 10.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
liquidjs is an npm package that provides a templating engine for JavaScript. It allows developers to render dynamic content using a simple and intuitive syntax. The package is widely used in web development projects to generate HTML, emails, and other text-based content. However, versions before 10.0.0 of liquidjs are vulnerable to an information exposure issue. When the ownPropertyOnly parameter is set to False, the package leaks properties of a prototype. This can potentially lead to unauthorized access to sensitive information or unintended exposure of internal implementation details.
Vulnerability Detail
The vulnerability in liquidjs arises from the improper handling of the ownPropertyOnly parameter. When this parameter is set to False, the package leaks properties of a prototype. This means that an attacker can access properties that were not intended to be exposed, potentially leading to information disclosure or other security issues. The impact of this vulnerability depends on the specific use case and the sensitivity of the data being leaked. It is important to note that versions 9.34.0 and higher of liquidjs provide an option to disable this functionality, mitigating the risk to some extent.
How To Fix
Latest published version: 10.30.0 as of 22 Oct 2026
npm install liquidjs@10.30.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.0.0
This is the first release that contains the fix.
npm install liquidjs@10.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For versions 9.34.0 and higher of liquidjs, a workaround is available to disable the functionality that causes the information exposure. Developers can set the ownPropertyOnly parameter to True to prevent the leakage of prototype properties. Here is an example of how to apply the workaround:
const engine = new Liquid({ ownPropertyOnly: true });
Conclusion
The liquidjs package before version 10.0.0 is vulnerable to information exposure when the ownPropertyOnly parameter is set to False. This can lead to the leakage of properties of a prototype, potentially resulting in unauthorized access to sensitive information. It is crucial for developers to upgrade to the latest version of liquidjs or apply the provided workaround to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for liquidjs →
FAQ
liquidjs is an npm package that provides a templating engine for JavaScript. It allows developers to render dynamic content using a simple and intuitive syntax.
The impact of this vulnerability depends on the specific use case and the sensitivity of the data being leaked. It can potentially lead to unauthorized access to sensitive information or unintended exposure of internal implementation details.
To fix this vulnerability, it is recommended to upgrade to version 10.0.0 or higher of liquidjs. This version includes a fix for the information exposure issue and ensures that properties of a prototype are not leaked.
Yes, for versions 9.34.0 and higher of liquidjs, a workaround is available. Developers can set the ownPropertyOnly parameter to True to prevent the leakage of prototype properties.
You can find more information about this vulnerability in the GitHub Advisory Database. The vulnerability is tracked under the identifier GHSA-45rm-2893-5f49.
References
Related vulnerabilities
Recent vulnerabilities recorded for liquidjs.
