CyberRota Analysis
AI-GeneratedPython Liquid versions prior to 2.2.1 are vulnerable to a denial of service attack due to an infinite loop triggered by malformed {% case %} tags lacking corresponding {% when %} or {% else %} blocks and a terminating {% endcase %} tag. This vulnerability can be exploited by malicious template authors to disrupt service availability. Organizations using affected versions should prioritize upgrading to version 2.2.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed {% case %} tag without an associated {% when %} or {% else %} block and no terminating {% endcase %} tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give the EOF token matching kind and value fields, allowing malicious template authors to craft templates for a denial of service attack. This issue is fixed in version 2.2.1.