Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
Vulnerability Description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaScript's `String.prototype.replace()` which interprets `$&` as a back reference to the matched substring. The filter only charges `memoryLimit` for the input string length, not the amplified output. An attacker can achieve exponential memory amplification (up to 625,000:1) while staying within the `memoryLimit` budget, leading to denial of service. Version 10.25.1 patches the issue.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability Type
输入验证不恰当
Vulnerability Title
liquidjs 安全漏洞
Vulnerability Description
liquidjs是Jun Yang个人开发者的一个简单、表达、安全且兼容 Shopify 的纯 JavaScript 模板引擎。 LiquidJS 10.25.1之前版本存在安全漏洞，该漏洞源于replace_first过滤器使用String.prototype.replace方法且内存限制计算不当，可能导致拒绝服务攻击。
CVSS Information
N/A
Vulnerability Type
N/A