CVE-2026-44644: LiquidJS strip_html XSS Bypass via Embedded Newlines

Technical summary

The vulnerability stems from an incomplete regex in the strip_html filter's catch-all branch. The pattern <.*?> fails to match line terminators (\n and \r), creating a bypass mechanism. An attacker can craft a payload such as <img\nsrc=x\nonerror=alert(1)> which the filter does not recognize as an HTML tag because the regex does not account for embedded newlines. The browser's HTML parser normalizes the whitespace and executes the handler, defeating the intended sanitization. The flaw is particularly severe because strip_html is widely relied upon as a primary XSS defense in applications using LiquidJS. The issue is compounded when applications do not enable outputEscape, which is the default configuration.

Business impact

Organizations using LiquidJS in user-facing web applications face direct XSS exposure. If attackers can inject attacker-controlled strings into template contexts and those strings are processed through strip_html, session hijacking, credential theft, malware delivery, and defacement become viable attack vectors. The default unsafe configuration (outputEscape disabled) means many deployments are vulnerable out of the box. This is particularly concerning for SaaS platforms, e-commerce sites, and content management systems that rely on LiquidJS for template rendering and user-submitted content sanitization.

Affected systems

LiquidJS versions 10.25.7 and below are vulnerable. Any application embedding LiquidJS as a dependency and using the strip_html filter on untrusted input without additional HTML escaping is at risk. This includes Shopify theme developers, static site generators using LiquidJS, and custom applications that have adopted the engine for template processing. The lack of a vendor patch alert (KEV status is false) indicates this is not yet considered actively exploited in the wild, but the public disclosure creates exploitation risk.

Exploitability

Exploitation requires two conditions: (1) the application must render attacker-controlled input through the {{ x | strip_html }} filter, and (2) the application must not separately HTML-escape the output (the default behavior). An attacker must be able to inject strings containing newline characters and HTML event handlers. The attack vector is network-based with low complexity and requires user interaction (a victim must view the malicious content in a browser). The accessibility of this attack depends on application design; many applications may have additional input validation or output encoding layers that would independently block the attack.

Remediation

Upgrade LiquidJS to version 10.26.0 or later, which fixes the regex pattern to correctly handle line terminators. Organizations should also review their LiquidJS configurations to enable outputEscape where possible, providing defense-in-depth protection against HTML injection. Beyond patching, audit all uses of strip_html in production templates and evaluate whether additional input validation or output encoding is warranted. Consider whether relying solely on strip_html for XSS defense is appropriate, or if a more robust HTML sanitization library is needed for high-risk applications.

Patch guidance

Verify the patch version against the vendor advisory: LiquidJS 10.26.0 and later contain the fix. Update your package.json or dependency manager to require the patched version, then rebuild and redeploy. Test template rendering with payloads containing newlines to confirm the filter now correctly removes tags. If you manage a Shopify app or theme, coordinate updates with your release pipeline to ensure compatibility with your use of LiquidJS. Monitor your dependencies for updates in case further issues are discovered.

Detection guidance

Monitor application logs for attempts to render templates with embedded newline characters in potential XSS payloads (patterns like %0a, \n, or &#10; followed by event handlers). Web application firewalls (WAF) can flag such payloads at the HTTP layer. Within LiquidJS templates, audit all {{ variable | strip_html }} expressions to identify which user inputs flow through this filter. In staging or development, fuzz the strip_html filter with payloads containing newlines and event handlers to verify the patched behavior. Runtime security tools that detect DOM-based XSS or event handler execution can catch bypass attempts.

Why prioritize this

Although the CVSS score is MEDIUM (6.1), the vulnerability is relevant to many web applications and developers rely on strip_html as a primary security control. The fact that it is not yet on the KEV list suggests it is not yet widely exploited, providing a window for proactive patching. The ease of exploitation once conditions are met—simple newline injection—justifies priority treatment for any organization using LiquidJS in production. Prompt patching reduces the risk window before exploitation becomes common.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects a network-accessible vulnerability with low attack complexity and no privilege requirement, but limited impact scope (affecting only the web application) and requiring user interaction. The score appropriately captures that this is a serious but not critical issue: it can lead to session hijacking or data theft in the user's browser, but does not directly compromise confidentiality or availability at system scale. However, the contextual severity is elevated for applications where strip_html is the sole XSS defense; such applications may warrant internal risk elevation.

Frequently asked questions