CVE-2026-33287

{"id": "CVE-2026-33287", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-03-26T01:16:27.530", "references": [{"url": "https://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaScript's `String.prototype.replace()` which interprets `$&` as a back reference to the matched substring. The filter only charges `memoryLimit` for the input string length, not the amplified output. An attacker can achieve exponential memory amplification (up to 625,000:1) while staying within the `memoryLimit` budget, leading to denial of service. Version 10.25.1 patches the issue."}, {"lang": "es", "value": "LiquidJS es un motor de plantillas compatible con Shopify / GitHub Pages en JavaScript puro. Antes de la versi\u00f3n 10.25.1, el filtro 'replace_first' en LiquidJS utiliza 'String.prototype.replace()' de JavaScript, que interpreta '$&' como una retroreferencia a la subcadena coincidente. El filtro solo carga 'memoryLimit' por la longitud de la cadena de entrada, no por la salida amplificada. Un atacante puede lograr una amplificaci\u00f3n exponencial de la memoria (hasta 625.000:1) mientras se mantiene dentro del presupuesto de 'memoryLimit', lo que lleva a una denegaci\u00f3n de servicio. La versi\u00f3n 10.25.1 corrige el problema."}], "lastModified": "2026-03-30T16:46:03.917", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "7E49E8C9-5FB9-40CA-BE2C-AC2B6553F472", "versionEndExcluding": "10.25.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}