CVE-2026-39412
1 advisory.
npm/liquidjs CVE-2026-39412: medium 5.3
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
Action: Upgrade liquidjs to 10.25.4 or later.
npm i liquidjs@10.25.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 10.25.4 | - |
Fixed versions
| 10.25.4 |
Sources
- osv: GHSA-rv5g-f82m-qrvv
- https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv
- https://nvd.nist.gov/vuln/detail/CVE-2026-39412
- https://github.com/harttle/liquidjs/pull/869
- https://github.com/harttle/liquidjs/commit/e743da0020d34e2ee547e1cc1a86b58377ebe1ce
- https://github.com/harttle/liquidjs
- https://github.com/harttle/liquidjs/releases/tag/v10.25.4
CVE-2026-39412 · published · modified · JSON