https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 14:54:45 +0000 https://vulnerability.circl.lu/vuln/ghsa-wmfp-5q7x-987x <p><strong>Affected:</strong> npm: liquidjs</p> <p>### Impact The `layout`, `render`, and `include` tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require `dynamicPartials: true`, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable.</p> <p>### Patches The root cause is LiquidJS allows `require.resolve()` as fallback but doesn&#39;t limit the directories it can resolve to. The issue is fixed via [#855](https://github.com/harttle/liquidjs/pull/855) and published version 10.25.0 on npm.</p> <p>### Workarounds #### Change the files in build time In build time, through Shell script or Webpack `string-replace-loader`, change the file content of correxponding file (depending on your package `type`, for CommonJS it&#39;s `dist/liquid.node.js`) under `dist/`,</p> <p>```diff if (fs.fallback !== undefined) { const filepath = fs.fallback(file) - if (filepath !== undefined) yield filepath + if (filepath !== undefined) { + for (const dir of dirs) { + if (!enforceRoot || this.contains(dir, filepath)) { + yield filepath + break + } + } } } ```</p> <p>#### Overriding by `fs` LiquidJS option Adding a [`fs` option](https://liquidjs.com/api/interfaces/FS.html) to override the [default `fs` implementation](https://github.com/harttle/liquidjs/blob/1b85fdaa9c535021f7030a239a64003af26d31b5/src/fs/fs-impl.ts#L36-L40):</p> <p>```javascript cons…</p> <p><strong>Affected:</strong> npm: liquidjs</p> <p>### Impact The `layout`, `render`, and `include` tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require `dynamicPartials: true`, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable.</p> <p>### Patches The root cause is LiquidJS allows `require.resolve()` as fallback but doesn&#39;t limit the directories it can resolve to. The issue is fixed via [#855](https://github.com/harttle/liquidjs/pull/855) and published version 10.25.0 on npm.</p> <p>### Workarounds #### Change the files in build time In build time, through Shell script or Webpack `string-replace-loader`, change the file content of correxponding file (depending on your package `type`, for CommonJS it&#39;s `dist/liquid.node.js`) under `dist/`,</p> <p>```diff if (fs.fallback !== undefined) { const filepath = fs.fallback(file) - if (filepath !== undefined) yield filepath + if (filepath !== undefined) { + for (const dir of dirs) { + if (!enforceRoot || this.contains(dir, filepath)) { + yield filepath + break + } + } } } ```</p> <p>#### Overriding by `fs` LiquidJS option Adding a [`fs` option](https://liquidjs.com/api/interfaces/FS.html) to override the [default `fs` implementation](https://github.com/harttle/liquidjs/blob/1b85fdaa9c535021f7030a239a64003af26d31b5/src/fs/fs-impl.ts#L36-L40):</p> <p>```javascript cons…</p> https://vulnerability.circl.lu/vuln/ghsa-wmfp-5q7x-987x