CVE-2026-106120: LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and for-loop iteration can read prototype-provided elements outside readJSProperty(). An attacker who can influence prototype state or inherited array-index data and cause templates to render affected operations can disclose values that ownPropertyOnly is expected to hide. Direct positive indexing and ordinary object prototype reads are blocked, but the alternate array paths remain affected. This issue is fixed in 10.27.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LiquidJSto a version that resolves this vulnerability.Fixed in 10.27.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using LiquidJS versions before 10.27.2 are exposed when ownPropertyOnly is enabled and templates render affected array operations. Exploitation also requires an attacker to influence prototype state or inherited array-index data.
Is ownPropertyOnly sufficient to prevent this disclosure?
No. Before 10.27.2, ownPropertyOnly blocks direct positive indexing and ordinary object prototype reads, but it does not consistently block inherited array indices through the affected alternate array-access paths.
Which template operations should be reviewed for exposure?
Review use of negative array indexes, .first and .last, the first and last filters, and the join, reverse, slice, and compact filters. For-loop iteration can also read prototype-provided array elements.
What should be done if the application cannot be upgraded immediately?
Avoid rendering templates that use the affected array operations with data whose prototype state or inherited array-index properties can be attacker-influenced. Upgrade to LiquidJS 10.27.2 to fix the issue.