Critical Remote Code Execution Vulnerability in LiquidJS Template Engine Exposes Enterprise Platforms

Overview

CVE-2026-45618 represents an unauthenticated remote code execution (RCE) vulnerability with CVSS 10.0 severity affecting LiquidJS versions prior to 10.26.0. This flaw exposes Shopify, GitHub Pages, and custom Node.js applications to server-side template injection attacks, enabling full system compromise through manipulated templates.

Technical Analysis

The vulnerability stems from improper sanitization of user-controlled inputs processed by LiquidJS's template engine. Attackers can craft malicious templates using tag/filter combinations (e.g., exploiting Node.js child_process modules) to bypass security boundaries. Exploitation requires any application rendering untrusted content via LiquidJS without input validation, making common web inputs (URL parameters, form fields, API endpoints) potential attack vectors.

Enterprise & DIB Impact

DIB and enterprise environments utilizing Shopify for e-commerce, GitHub Pages for documentation, or custom LiquidJS integrations face severe data breach risks. A successful exploit grants full server control, enabling data exfiltration, service disruption, or lateral movement within internal networks.

Recommended Actions

• Upgrade LiquidJS to version 10.26.0 immediately
• validate and sanitize all user-controlled inputs before template rendering
• implement runtime monitoring for suspicious expression patterns
• disable unnecessary LiquidJS features (e.g.
• custom filters)
• conduct code reviews for template injection risks in legacy applications