CyberRota Analysis
AI-GeneratedLiquidJS, a template engine used in Shopify and GitHub Pages, is vulnerable to a memory allocation issue that can lead to excessive memory usage when processing large arrays, specifically through the pop array filter. This flaw allows an attacker to influence the input array, potentially causing denial-of-service conditions by exceeding the configured memory limit. Developers and security teams using versions prior to 10.27.1 should prioritize updating to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filter at src/filters/array.ts allocated a full clone of its input array via [...toArray(v)] without calling this.context.memoryLimit.use(...), allowing a template render such as {{ huge_array | pop }} to allocate an O(N) clone of an attacker-influenced array outside the configured memoryLimit budget. This issue is fixed in version 10.27.1.