Loading story…
Belgium’s Centre for Cybersecurity has warned of a critical remote code execution flaw in the LiquidJS template engine, and public reporting identifies the issue as CVE-2026-45618 with a CVSS score of 10.0. The vulnerability affects LiquidJS versions 10.25.7 and earlier and stems from improper input validation during filter evaluation, which can let an attacker reach the internal execution context, manipulate internal functions, and obtain access to the JavaScript Function constructor.
Successful exploitation could allow arbitrary command execution and access to sensitive files, creating a path to full system compromise in applications that process untrusted templates. LiquidJS is widely used to bring Shopify, Jekyll, and GitHub Pages-style templating to Node.js environments and is reported to have more than 7.3 million monthly downloads, expanding the downstream exposure. Maintainers have addressed the flaw in LiquidJS 10.27.0, and defenders are being urged to inventory affected systems and upgrade immediately.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
LiquidJS maintainers released a fix for the remote code execution flaw in version 10.27.0. Organizations were advised to inventory affected environments and upgrade immediately.
A critical remote code execution vulnerability in the LiquidJS template engine, tracked as CVE-2026-45618 and rated CVSS 10.0, was publicly disclosed. The flaw affects LiquidJS versions 10.25.7 and earlier and could allow arbitrary command execution through improper input validation during filter evaluation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution vulnerability, tracked as **`CVE-2026-45618`**, was disclosed in the **LiquidJS** template engine from harttle. The flaw affects versions earlier than **`10.26.0`** and allows arbitrary code execution through crafted templates, with a **CVSS 3.1** score reflecting network-exploitable impact without privileges or user interaction. The issue is classified as **`CWE-94`**, indicating improper control of code generation that can lead to command execution. Harttle addressed the issue in **LiquidJS `v10.26.0`** by blocking **`Object.prototype`** filter and tag lookups, the behavior identified as enabling the RCE condition. The same release also rewrote **`strip_html`** as a linear single-pass scan to reduce **ReDoS** risk and included additional bug fixes and new `sha256` and `hmac_sha256` filters. Organizations using LiquidJS should upgrade to **`10.26.0`** or later to remediate the vulnerability.
Aug 12, 2026
A critical security vulnerability, tracked as CVE-2025-61927, has been discovered in the Happy DOM JavaScript library, which is widely used for server-side rendering and testing frameworks. The flaw allows attackers to escape the virtual machine (VM) context, potentially leading to remote code execution on affected systems. Happy DOM, with over 2.7 million weekly downloads, is integrated into numerous applications, amplifying the potential impact of this vulnerability. The root cause of the issue lies in improper isolation of the Node.js VM context in Happy DOM versions 19 and earlier, which fails to adequately sandbox untrusted code. Security researcher Mas0nShi identified that attackers can exploit the JavaScript constructor inheritance chain to access the global Function constructor, enabling arbitrary code execution. In environments using the CommonJS module system, attackers can further leverage the require() function to import and execute additional modules, broadening the attack surface. While ECMAScript module (ESM) environments restrict some capabilities, they are still affected by the core VM context escape. The vulnerability has been assigned a CVSS score of 9.4, underscoring its severity and the urgency for remediation. Millions of applications that rely on Happy DOM for testing or server-side rendering are at risk if they have not updated to a patched version. The flaw enables attackers to bypass intended security boundaries, potentially compromising the host system and any sensitive data processed within the affected environment. Security advisories recommend immediate updates to the latest version of Happy DOM to mitigate the risk. Organizations are urged to review their software supply chain for dependencies on Happy DOM and to apply patches as soon as possible. The vulnerability highlights the risks associated with improper sandboxing in JavaScript environments, especially in widely adopted open-source libraries. No reports of active exploitation have been confirmed at this time, but the public disclosure and technical details increase the likelihood of exploitation attempts. Security teams should monitor for suspicious activity related to Node.js processes and review application logs for signs of compromise. The incident serves as a reminder of the importance of rigorous security testing and isolation in libraries that execute untrusted code. Developers and DevOps teams should prioritize dependency management and vulnerability scanning to reduce exposure to similar flaws in the future.
Jun 29, 2026
A critical **server-side template injection** flaw tracked as `CVE-2026-54390` affects **JTL Shop** versions **5.2.0 through 5.7.1**, where unsanitized user input is passed to the **Smarty** template engine. The vulnerability allows **unauthenticated remote attackers** to inject malicious template syntax and access sensitive server-side information, including **database credentials** and **encryption keys**. On **JTL Shop 5.4.0 through 5.7.1**, the flaw can be escalated to **remote code execution** by abusing registered Smarty modifiers such as `unserialize` and `file_get_contents` to write a **webshell** into the web root and run arbitrary commands as the web server user. The issue has been rated **critical** with **CVSS 3.1 9.8** and **CVSS 4.0 9.3**, and affected organizations are advised to upgrade to **JTL Shop 5.7.2 or later** and ensure user input reaching the template engine is properly sanitized.
Jun 29, 2026