Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read
Vulnerability Description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, liquidjs 10.25.0 documents root as constraining filenames passed to renderFile() and parseFile(), but top-level file loads do not enforce that boundary. A Liquid instance configured with an empty temporary directory as root can return the contents of arbitrary files. This vulnerability is fixed in 10.25.3.
CVSS Information
N/A
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Vulnerability Title
liquidjs 路径遍历漏洞
Vulnerability Description
liquidjs是Jun Yang个人开发者的一个简单、表达、安全且兼容 Shopify 的纯 JavaScript 模板引擎。 LiquidJS 10.25.3之前版本存在路径遍历漏洞，该漏洞源于根目录限制未强制执行，可能导致返回任意文件内容。
CVSS Information
N/A
Vulnerability Type
N/A