{"action":"Upgrade liquidjs to 10.27.2 or later.","affected":[{"fixed":"10.27.2","introduced":"0"}],"component":"liquidjs","cve_ids":["CVE-2026-106120"],"ecosystem":"npm","epss":0.00409,"exploited":false,"fixed_versions":["10.27.2"],"ghsa_id":"GHSA-fwxr-j5w2-587m","id":"tcs_01M5KFPHB9QN0Z71PEJG5B9YCS","modified_at":"2026-10-07T16:30:04.720886113Z","published_at":"2026-10-07T16:19:09Z","references":["https://osv.dev/vulnerability/GHSA-fwxr-j5w2-587m","https://github.com/harttle/liquidjs/security/advisories/GHSA-fwxr-j5w2-587m","https://nvd.nist.gov/vuln/detail/CVE-2026-106120","https://github.com/harttle/liquidjs/pull/924","https://github.com/harttle/liquidjs/commit/552819a84b80c62306fe61072628a756272dc749","https://github.com/harttle/liquidjs","https://github.com/harttle/liquidjs/releases/tag/v10.27.2"],"severity":{"label":"medium","score":6},"sources":[{"source":"osv","source_id":"GHSA-fwxr-j5w2-587m","url":"https://osv.dev/vulnerability/GHSA-fwxr-j5w2-587m"},{"source":"nvd","source_id":"CVE-2026-106120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106120"}],"summary":"LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration"}