CVE-2026-106120: LiquidJS Information Disclosure via ownPropertyOnly Bypass
Summary
CVE-2026-106120: LiquidJS’s ownPropertyOnly option is intended to prevent templates from reading inherited or prototype properties from scope data. Affects liquidjs versions < 10.27.2. Fixed in 10.27.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LiquidJS is a powerful templating engine for JavaScript that allows developers to create dynamic web applications by rendering templates with data. It supports various features such as filters, loops, and custom tags, making it a versatile choice for developers. However, it has a vulnerability related to its 'ownPropertyOnly' option, which is designed to prevent access to inherited properties in scope data.
Vulnerability Detail
The vulnerability arises from LiquidJS's 'ownPropertyOnly' option, which is intended to block access to inherited or prototype properties. While direct access to properties like 'a[0]' is correctly restricted, inherited array indices can still be accessed through methods such as '.first', '.last', negative indexing, and for-loop iterations. This inconsistency can lead to information disclosure when applications rely on 'ownPropertyOnly: true' to secure templates against untrusted data. An attacker can exploit this flaw by manipulating prototype states to expose sensitive information.
How To Fix
Latest published version: 10.30.0 as of 22 Oct 2026
npm install liquidjs@10.30.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.27.2
This is the first release that contains the fix.
npm install liquidjs@10.27.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'ownPropertyOnly' option if your application processes untrusted data. Additionally, ensure that your application does not allow prototype pollution, which can be done by validating and sanitizing input data.
Conclusion
In summary, CVE-2026-106120 is a vulnerability in LiquidJS that allows for information disclosure through inherited array indices despite the 'ownPropertyOnly' option being enabled. It is crucial for developers to update to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for liquidjs →
FAQ
The vulnerability can lead to information disclosure, allowing attackers to access inherited properties that should be restricted.
You can use Vulert to monitor your application for vulnerabilities. Simply upload your package-lock.json file to receive real-time alerts.
The CVSS score for this vulnerability is 6.0, indicating a moderate severity level.
While updating is the best solution, you can temporarily avoid using the 'ownPropertyOnly' option and sanitize input data.
You can find more information about LiquidJS and its features on its official GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for liquidjs.
