CVE-2026-44646: LiquidJS Context.spawn() Silent Security Bypass in Template Rendering

Technical summary

CVE-2026-44646 involves improper context inheritance in LiquidJS versions 10.25.7 and below. The Context.spawn() method, invoked during {% render %} tag processing, fails to propagate the resolved ownPropertyOnly setting from the parent context to the child context. Instead, it re-derives ownPropertyOnly exclusively from the instance-level opts.ownPropertyOnly configuration, discarding any RenderOptions.ownPropertyOnly override passed to parseAndRender(). This creates a bypass of per-call security constraints: a developer running a Liquid engine with backwards-compatible ownPropertyOnly:false can attempt to isolate untrusted templates via parseAndRender(..., { ownPropertyOnly: true }), yet prototype-chain properties remain accessible within {% render %} partials. The vulnerability is rooted in Context.spawn() but manifests as a distinct attack vector independent of the array-filter variants (where, reject, group_by, find, find_index, has) that were previously disclosed.

Business impact

Organizations using LiquidJS to process untrusted templates face information disclosure risk. If a deployment relies on per-template security locks (ownPropertyOnly: true in parseAndRender calls) to sandbox user-supplied or third-party Liquid templates, those locks fail silently within {% render %} partials. An attacker crafting a template can extract sensitive data from the JavaScript runtime's prototype chain—potentially including configuration objects, internal library properties, or other unintended application state. The silent failure means developers may be unaware their security assumptions are violated, increasing dwell time before detection.

Affected systems

LiquidJS versions 10.25.7 and earlier are affected. Version 10.26.0 and later include the fix. Any application embedding LiquidJS for template rendering—particularly those handling untrusted templates or using per-call ownPropertyOnly enforcement—should audit their deployment version and update accordingly. This includes Shopify app developers, static site generators using LiquidJS, and JavaScript backend services that render user-supplied Liquid templates.

Exploitability

Exploitation requires the ability to supply or influence Liquid template content that will be processed by a vulnerable LiquidJS instance. No authentication, interaction, or special network conditions are required. An attacker crafting a template with {% render %} tags can attempt prototype-chain traversal within the rendered partials. The attack is reliable and does not depend on user interaction or complex exploitation chains. However, successful information extraction depends on what sensitive properties exist in the application's prototype chain, which varies by use case.

Remediation

Upgrade LiquidJS to version 10.26.0 or later, which correctly propagates ownPropertyOnly settings through Context.spawn(). Developers should verify their deployment version immediately and prioritize patching in any environment processing untrusted templates. After upgrading, no configuration changes are necessary; the fix restores the intended behavior of per-call security overrides.

Patch guidance

Update the LiquidJS dependency to version 10.26.0 or higher. If using npm, run 'npm install liquidjs@^10.26.0'. Verify the upgrade by checking node_modules/liquidjs/package.json or running 'npm list liquidjs'. For applications in production, apply the patch in a staging environment first to confirm no template rendering behavior changes occur. The fix is backwards compatible and does not require updates to Liquid templates or application code.

Detection guidance

Identify instances of LiquidJS in use by examining package.json, package-lock.json, or yarn.lock files for liquidjs entries with version <= 10.25.7. In production, review any logs or monitoring for unusual prototype-chain access patterns, though this is difficult to detect without explicit instrumentation. Consider adding logging around parseAndRender() calls to track which security options are being set, and correlate that with actual rendering outcomes. If you have detailed template audit logs, look for {% render %} directives that appear after tightened security settings; these are the attack surface.

Why prioritize this

Although the CVSS score of 5.3 (Medium) reflects a confidentiality-only impact with low attack complexity, the vulnerability is particularly concerning because it represents a silent bypass of developer-intended security controls. Developers explicitly setting ownPropertyOnly: true have no indication their setting is ineffective within partials, creating a false sense of security. In multi-tenant or untrusted-template scenarios, this is a high-priority fix despite the medium rating. Patch quickly if you use LiquidJS with per-template security enforcement.

Risk score, explained

CVSS 5.3 reflects attack network accessibility (AV:N), low complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), and low confidentiality impact (C:L) with unchanged integrity and availability. The score correctly captures that this is an information disclosure via a network-accessible template engine, but it does not weight the significance of the security-control bypass or the likelihood of an attacker having template submission capability in real deployments. Organizations with high-sensitivity data in prototype chains or applications accepting untrusted templates should treat this as high-priority despite the medium score.

Frequently asked questions