CVE-2026-44644
1 advisory.
npm/liquidjs CVE-2026-44644: medium 6.1, EPSS 0.36%
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 10.25.7 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-2qv6-9wx5-cwv4
- https://github.com/harttle/liquidjs/security/advisories/GHSA-2qv6-9wx5-cwv4
- https://nvd.nist.gov/vuln/detail/CVE-2026-44644
- https://github.com/harttle/liquidjs/commit/26ea2856c7a90aec892b98d94a9b7a3e18539045
- https://github.com/harttle/liquidjs
- https://github.com/harttle/liquidjs/releases/tag/v10.26.0
CVE-2026-44644 · published · modified · JSON