{"action":"Upgrade liquidjs to 10.27.1 or later.","affected":[{"fixed":"10.27.1","introduced":"0"}],"component":"liquidjs","cve_ids":["CVE-2026-55575"],"ecosystem":"npm","epss":0.00524,"exploited":false,"fixed_versions":["10.27.1"],"ghsa_id":"GHSA-g357-x5c3-c72p","id":"tcs_01M5KFPTCBP45PHXRC5ZPC0TZJ","modified_at":"2026-07-24T14:15:32.911642903Z","published_at":"2026-07-24T14:05:20Z","references":["https://osv.dev/vulnerability/GHSA-g357-x5c3-c72p","https://github.com/harttle/liquidjs/security/advisories/GHSA-g357-x5c3-c72p","https://nvd.nist.gov/vuln/detail/CVE-2026-55575","https://github.com/harttle/liquidjs/pull/907","https://github.com/harttle/liquidjs/commit/8a0c74a7fcb1671aa1dcb71ec82ba0602dc90d04","https://github.com/harttle/liquidjs","https://github.com/harttle/liquidjs/releases/tag/v10.27.1"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-g357-x5c3-c72p","url":"https://osv.dev/vulnerability/GHSA-g357-x5c3-c72p"}],"summary":"LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce"}