CVE-2026-61556: LiquidJS: An infinite loop vulnerability in `strip_html` filter
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the striphtml filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In striphtml, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a<. This issue is fixed in version 10.27.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LiquidJSto a version that resolves this vulnerability.Fixed in 10.27.1
Event History
Frequently Asked Questions
What inputs can trigger the denial of service?
A string processed by the strip_html filter can trigger the loop if it contains a '<' character with at least one character before it and no later '>' character. The described proof-of-concept input is "a<".
Who can realistically exploit this issue?
An attacker would need to cause attacker-controlled or otherwise malformed text matching the trigger condition to be processed by LiquidJS's strip_html filter. Successful exploitation blocks template rendering through an infinite loop.
Which versions need remediation?
The issue affects LiquidJS versions from 10.26.0 until 10.27.1. Version 10.27.1 fixes the vulnerability.