{"action":"Upgrade liquidjs to 10.27.1 or later.","affected":[{"fixed":"10.27.1","introduced":"10.26.0"}],"component":"liquidjs","cve_ids":["CVE-2026-61556"],"ecosystem":"npm","epss":0.00524,"exploited":false,"fixed_versions":["10.27.1"],"ghsa_id":"GHSA-m7fp-h3p4-hr49","id":"tcs_01M5KFZZZT5RBYE4YZ3VGXXF8P","modified_at":"2026-09-03T18:00:04.447368207Z","published_at":"2026-09-03T17:45:26Z","references":["https://osv.dev/vulnerability/GHSA-m7fp-h3p4-hr49","https://github.com/harttle/liquidjs/security/advisories/GHSA-m7fp-h3p4-hr49","https://nvd.nist.gov/vuln/detail/CVE-2026-61556","https://github.com/harttle/liquidjs/pull/917","https://github.com/harttle/liquidjs/commit/5c3522f33928aae66f0fe85c36e1d9015c768fe2","https://github.com/harttle/liquidjs","https://github.com/harttle/liquidjs/releases/tag/v10.27.1"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-m7fp-h3p4-hr49","url":"https://osv.dev/vulnerability/GHSA-m7fp-h3p4-hr49"},{"source":"nvd","source_id":"CVE-2026-61556","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61556"}],"summary":"LiquidJS has an infinite loop vulnerability in its `strip_html` filter"}