CVE-2026-106120

Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.27.2

Description When the ownPropertyOnly setting is enabled, the engine fails to consistently restrict inherited array indices. This occurs because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and for-loop iteration can access prototype-provided elements by bypassing the readJSProperty() function. An attacker capable of influencing the prototype state or inherited array-index data can cause templates to render these operations and disclose values that ownPropertyOnly is intended to hide.

Recommendations Update LiquidJS to version 10.27.2.