{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-19T15:18:48.256","vulnerabilities":[{"cve":{"id":"CVE-2026-33287","sourceIdentifier":"security-advisories@github.com","published":"2026-03-26T01:16:27.530","lastModified":"2026-03-30T16:46:03.917","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaScript's `String.prototype.replace()` which interprets `$&` as a back reference to the matched substring. The filter only charges `memoryLimit` for the input string length, not the amplified output. An attacker can achieve exponential memory amplification (up to 625,000:1) while staying within the `memoryLimit` budget, leading to denial of service. Version 10.25.1 patches the issue."},{"lang":"es","value":"LiquidJS es un motor de plantillas compatible con Shopify / GitHub Pages en JavaScript puro. Antes de la versión 10.25.1, el filtro 'replace_first' en LiquidJS utiliza 'String.prototype.replace()' de JavaScript, que interpreta '$&' como una retroreferencia a la subcadena coincidente. El filtro solo carga 'memoryLimit' por la longitud de la cadena de entrada, no por la salida amplificada. Un atacante puede lograr una amplificación exponencial de la memoria (hasta 625.000:1) mientras se mantiene dentro del presupuesto de 'memoryLimit', lo que lleva a una denegación de servicio. La versión 10.25.1 corrige el problema."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:node.js:*:*","versionEndExcluding":"10.25.1","matchCriteriaId":"7E49E8C9-5FB9-40CA-BE2C-AC2B6553F472"}]}]}],"references":[{"url":"https://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}}]}