CVE-2026-45618

CVSS 10.0 (critical) · published 2026-08-11

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.

Weakness: CWE-94

Source: NVD CVE-2026-45618

References

• https://github.com/harttle/liquidjs/releases/tag/v10.26.0
• https://github.com/harttle/liquidjs/security/advisories/GHSA-gf2q-c269-pqgc
• https://github.com/harttle/liquidjs/security/advisories/GHSA-gf2q-c269-pqgc

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.