Skip to content

RadicalNotion.AI

We do not sell or share your personal information.

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Log in Create an account

Home
Patched Functions
Harttle
Liquidjs

harttle/liquidjs: Functions Patched by CVE Fixes

typescript

#303 of 500 repositories

harttle/liquidjs

Functions and files changed by CVE fixes in this repository.

Latest located fix October 6, 2026

18

CVE fixes located

Published CVEs

49

Functions patched

Distinct function sites

21

Files patched

Distinct source files

2022–2026

Years covered

By CVE publication date

Overview

18 published CVEs have a fix traced to functions in harttle/liquidjs, the earliest published in 2022. Those fixes changed 49 distinct functions across 21 files, in 152 patch hunks.

Among the 500 repositories tracked here, harttle/liquidjs ranks #303 by the number of CVEs with a located fix.

Most patched functions

Functions in harttle/liquidjs changed by the most CVE fixes.

1strip_htmlsrc/filters/html.ts2 CVEs · 3 patches2026
2readFirstsrc/context/context.ts1 CVEs · 2 patches2026
3compactsrc/filters/array.ts1 CVEs · 2 patches2026
4callsrc/filters/array.ts1 CVEs · 2 patches2026
5readArrayElementsrc/util/underscore.ts1 CVEs · 2 patches2026
6chargeJsonReplacerValuesrc/filters/misc.ts1 CVEs · 2 patches2026
7array_to_sentence_stringsrc/filters/string.ts1 CVEs · 2 patches2026
8samplesrc/filters/array.ts1 CVEs · 2 patches2026
9popsrc/filters/array.ts1 CVEs · 2 patches2026
10sort_naturalsrc/filters/array.ts1 CVEs · 2 patches2026
11orderedComparesrc/util/underscore.ts1 CVEs · 2 patches2026
12candidatessrc/fs/loader.ts1 CVEs · 2 patches2026
13readPropertysrc/context/context.ts1 CVEs · 2 patches2022
14jsonsrc/filters/misc.ts1 CVEs · 1 patches2026
15strftimesrc/filters/date.ts1 CVEs · 1 patches2026

Most patched files

Files in harttle/liquidjs changed by the most CVE fixes.

1src/context/context.ts4 CVEs · 7 functions
2src/filters/array.ts4 CVEs · 5 functions
3src/fs/loader.ts3 CVEs · 5 functions
4src/filters/string.ts3 CVEs · 3 functions
5src/util/underscore.ts3 CVEs · 3 functions
6src/filters/html.ts3 CVEs · 2 functions
7src/liquid-options.ts2 CVEs · 3 functions
8src/parser/parser.ts1 CVEs · 3 functions
9src/util/strftime.ts1 CVEs · 3 functions
10src/filters/date.ts1 CVEs · 2 functions

Fix size

How much code a CVE fix in harttle/liquidjs changes, with backports counted once.

18

Median lines changed

Added plus removed, per CVE

56%

Fixes of 20 lines or fewer

Share of CVE fixes

50%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in harttle/liquidjs, and the functions each fix changed.

LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration
CVE-2026-106120readFirst Context readArrayElement
Medium · CVSS 6.0
EPSS 0.4%2026-10-06
LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
CVE-2026-69222chargeJsonReplacerValue json array_to_sentence_string
High · CVSS 7.5
EPSS 0.6%2026-08-19
LiquidJS: An infinite loop vulnerability in `strip_html` filter
CVE-2026-61556strip_html
High · CVSS 8.7
EPSS 0.5%2026-08-19
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
CVE-2026-55575pop sample
High · CVSS 8.2
EPSS 0.5%2026-07-08
LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime)
CVE-2026-45357strftime pad date
High · CVSS 7.5
EPSS 0.7%2026-06-17
LiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
CVE-2026-44646Context
Medium · CVSS 5.3
EPSS 0.4%2026-06-17
LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex
CVE-2026-45617newline_to_br
High · CVSS 7.5
EPSS 0.7%2026-06-17
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
CVE-2026-44645Render
Medium · CVSS 6.5
EPSS 0.6%2026-06-17
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
CVE-2026-44644strip_html
Medium · CVSS 6.1
EPSS 0.4%2026-06-17
LiquidJS is vulnerable to Denial of Service via circular block reference in layout
CVE-2026-41311render extends getRegister
High · CVSS 7.5
EPSS 0.6%2026-05-09
LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read
CVE-2026-39859lookup
Medium · CVSS 6.3
EPSS 0.5%2026-04-08
LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
CVE-2026-39412sort_natural orderedCompare ScopeObject
High · CVSS 7.5
EPSS 0.5%2026-04-08

Get an alert for each new harttle/liquidjs CVE, with the patched functions and AI-written analysis.

Monitor liquidjs CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

apache/roller18 CVEs chatwoot/chatwoot18 CVEs containerd/containerd18 CVEs debian/ntfs-3g18 CVEs decidim/decidim18 CVEs dompdf/dompdf18 CVEs facebook/hermes18 CVEs frangoteam/FUXA18 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in harttle/liquidjs.

How many CVEs have a located fix in harttle/liquidjs?: 18 published CVEs have a fix traced to functions in harttle/liquidjs, touching 49 functions across 21 files.
Which function in harttle/liquidjs has been patched by the most CVEs?: strip_html in src/filters/html.ts has been changed by 2 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in harttle/liquidjs?: The median fix changes 18 lines. 56% of fixes change 20 lines or fewer, and 50% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

harttle/liquidjs on GitHub (opens in a new tab)
Patched functions directory
CWE directory: the weakness types behind these fixes

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track harttle/liquidjs CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing

On this page

Overview
Most patched functions
Most patched files
Fix size
Latest CVEs
Other repositories
FAQ
References