{"cve":"CVE-2026-39412","nvd":{"published":"2026-04-08T20:16:25.733","modified":"2026-07-24T21:10:00.143","status":"Analyzed","description":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.4, the sort_natural filter bypasses the ownPropertyOnly security option, allowing template authors to extract values of prototype-inherited properties through a sorting side-channel attack. Applications relying on ownPropertyOnly: true as a security boundary (e.g., multi-tenant template systems) are exposed to information disclosure of sensitive prototype properties such as API keys and tokens. This vulnerability is fixed in 10.25.4.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-200"],"references":["https://github.com/harttle/liquidjs/commit/e743da0020d34e2ee547e1cc1a86b58377ebe1ce","https://github.com/harttle/liquidjs/pull/869","https://github.com/harttle/liquidjs/releases/tag/v10.25.4","https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv","https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv"],"products":["liquidjs:liquidjs"],"source":"nvd","synced_at":"2026-10-19T22:28:59.047572785+00:00"},"epss":{"cve":"CVE-2026-39412","score":0.00403,"percentile":0.34578,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-rv5g-f82m-qrvv","url":"https://osv.dev/vulnerability/GHSA-rv5g-f82m-qrvv","summary":"LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel","modified":"2026-09-10T03:51:03.225634128Z","packages":[{"ecosystem":"npm","name":"liquidjs","purl":"pkg:npm/liquidjs","ranges":["<10.25.4"],"fixed":["10.25.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}