Loading story…
A critical remote code execution vulnerability, tracked as CVE-2026-45618, was disclosed in the LiquidJS template engine from harttle. The flaw affects versions earlier than 10.26.0 and allows arbitrary code execution through crafted templates, with a CVSS 3.1 score reflecting network-exploitable impact without privileges or user interaction. The issue is classified as CWE-94, indicating improper control of code generation that can lead to command execution.
Harttle addressed the issue in LiquidJS v10.26.0 by blocking Object.prototype filter and tag lookups, the behavior identified as enabling the RCE condition. The same release also rewrote strip_html as a linear single-pass scan to reduce ReDoS risk and included additional bug fixes and new sha256 and hmac_sha256 filters. Organizations using LiquidJS should upgrade to 10.26.0 or later to remediate the vulnerability.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On August 11, 2026, GitHub advisory and release references were published for CVE-2026-45618, including the GHSA-gf2q-c269-pqgc advisory and the LiquidJS v10.26.0 fix reference. The disclosure tied the critical RCE issue to LiquidJS versions before 10.26.0.
A new CVE record for CVE-2026-45618 was received by security-advisories@github.com on August 11, 2026. The vulnerability affects LiquidJS versions earlier than 10.26.0 and allows arbitrary code execution through crafted templates.
Harttle released LiquidJS version 10.26.0 on 2026-05-14. The release notes state it blocks Object.prototype filter and tag lookups to prevent remote code execution, alongside other fixes and features.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Belgium’s Centre for Cybersecurity has warned of a **critical remote code execution** flaw in the LiquidJS template engine, and public reporting identifies the issue as `CVE-2026-45618` with a **CVSS score of 10.0**. The vulnerability affects LiquidJS versions **10.25.7 and earlier** and stems from improper input validation during filter evaluation, which can let an attacker reach the internal execution context, manipulate internal functions, and obtain access to the JavaScript `Function` constructor. Successful exploitation could allow arbitrary command execution and access to sensitive files, creating a path to full system compromise in applications that process untrusted templates. LiquidJS is widely used to bring Shopify, Jekyll, and GitHub Pages-style templating to Node.js environments and is reported to have more than **7.3 million monthly downloads**, expanding the downstream exposure. Maintainers have addressed the flaw in **LiquidJS 10.27.0**, and defenders are being urged to inventory affected systems and upgrade immediately.
Jun 29, 2026
A critical security vulnerability, tracked as CVE-2025-61927, has been discovered in the Happy DOM JavaScript library, which is widely used for server-side rendering and testing frameworks. The flaw allows attackers to escape the virtual machine (VM) context, potentially leading to remote code execution on affected systems. Happy DOM, with over 2.7 million weekly downloads, is integrated into numerous applications, amplifying the potential impact of this vulnerability. The root cause of the issue lies in improper isolation of the Node.js VM context in Happy DOM versions 19 and earlier, which fails to adequately sandbox untrusted code. Security researcher Mas0nShi identified that attackers can exploit the JavaScript constructor inheritance chain to access the global Function constructor, enabling arbitrary code execution. In environments using the CommonJS module system, attackers can further leverage the require() function to import and execute additional modules, broadening the attack surface. While ECMAScript module (ESM) environments restrict some capabilities, they are still affected by the core VM context escape. The vulnerability has been assigned a CVSS score of 9.4, underscoring its severity and the urgency for remediation. Millions of applications that rely on Happy DOM for testing or server-side rendering are at risk if they have not updated to a patched version. The flaw enables attackers to bypass intended security boundaries, potentially compromising the host system and any sensitive data processed within the affected environment. Security advisories recommend immediate updates to the latest version of Happy DOM to mitigate the risk. Organizations are urged to review their software supply chain for dependencies on Happy DOM and to apply patches as soon as possible. The vulnerability highlights the risks associated with improper sandboxing in JavaScript environments, especially in widely adopted open-source libraries. No reports of active exploitation have been confirmed at this time, but the public disclosure and technical details increase the likelihood of exploitation attempts. Security teams should monitor for suspicious activity related to Node.js processes and review application logs for signs of compromise. The incident serves as a reminder of the importance of rigorous security testing and isolation in libraries that execute untrusted code. Developers and DevOps teams should prioritize dependency management and vulnerability scanning to reduce exposure to similar flaws in the future.
Jun 29, 2026
A critical pre-authentication remote code execution flaw, tracked as **`CVE-2025-55182`** and dubbed **React2Shell**, was disclosed in React Server Components and related React Flight server-side deserialization logic used by **React.js**, **Next.js**, and similar frameworks. The vulnerability affects React Server Components versions **19.0.0**, **19.1.0**, **19.1.1**, and **19.2.0** in the packages **`react-server-dom-webpack`**, **`react-server-dom-parcel`**, and **`react-server-dom-turbopack`**, where unsafe deserialization of HTTP request payloads sent to Server Function endpoints can lead to arbitrary code execution in Node.js before authentication. Public reporting said the flaw was fixed in the React repository through pull request **`#35277`**, and vendor advisories and CISA tracking indicate the issue drew urgent attention. Security researchers later reported active in-the-wild exploitation beginning almost immediately after disclosure, with mass scanning followed by deployment of **Cobalt Strike**, **Sliver**, cryptominers, reverse proxies, a Go backdoor, botnet activity, and a Node.js **Secret-Hunter** payload aimed at stealing credentials and secrets. Observed campaigns targeted both Linux and Windows systems, and analysis tied the root cause to improper property ownership checks in React's `reviveModel` function that allowed attacker-controlled serialized payloads to traverse prototype properties. The official patch replaced unsafe ownership checks with **`Object.prototype.hasOwnProperty.call(...)`**, added explicit handling for **`__proto__`**, and prompted guidance to upgrade affected React and Next.js deployments and monitor exposed Server Function endpoints for exploitation attempts.
Sep 1, 2026