CVE-2026-39412
MEDIUMLiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
Title source: cnaDescription
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.4, the sort_natural filter bypasses the ownPropertyOnly security option, allowing template authors to extract values of prototype-inherited properties through a sorting side-channel attack. Applications relying on ownPropertyOnly: true as a security boundary (e.g., multi-tenant template systems) are exposed to information disclosure of sensitive prototype properties such as API keys and tokens. This vulnerability is fixed in 10.25.4.
Scores
CVSS v3
5.3
EPSS
0.0001
EPSS Percentile
2.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (3)
harttle/liquidjs
< 10.25.4
liquidjs/liquidjs
< 10.25.4
npm/liquidjs
0 - 10.25.4npm
Published
Apr 08, 2026
Tracked Since
Apr 09, 2026