Vulnerability	Vulnerable Version
M Infinite loop python-liquid is an A Python engine for the Liquid template language. Affected versions of this package are vulnerable to Infinite loop in the `{% case %}` tag parsing logic, caused by an incorrect definition of the EOF token's `kind` and `value` in the `TokenStream.eof` attribute. A user who can author or supply templates can hang the parser and cause a denial of service by providing a `{% case %}` tag that has no `{% when %}` or `{% else %}` branch and no terminating `{% endcase %}`. Exploitation requires the application to parse template source supplied by untrusted authors, and the hang occurs at parse time. How to fix Infinite loop? Upgrade `python-liquid` to version 2.2.1 or higher.	[,2.2.1)
H Directory Traversal python-liquid is an A Python engine for the Liquid template language. Affected versions of this package are vulnerable to Directory Traversal via the `FileSystemLoader` and `CachingFileSystemLoader` components. An attacker can access and render arbitrary files outside the intended search path by supplying absolute paths through template tags. This is only exploitable if the targeted files contain valid markup and are readable by the application process. How to fix Directory Traversal? Upgrade `python-liquid` to version 2.2.0 or higher.	[,2.2.0)

Infinite loop

python-liquid is an A Python engine for the Liquid template language.

Affected versions of this package are vulnerable to Infinite loop in the {% case %} tag parsing logic, caused by an incorrect definition of the EOF token's kind and value in the TokenStream.eof attribute. A user who can author or supply templates can hang the parser and cause a denial of service by providing a {% case %} tag that has no {% when %} or {% else %} branch and no terminating {% endcase %}. Exploitation requires the application to parse template source supplied by untrusted authors, and the hang occurs at parse time.

How to fix Infinite loop?

Upgrade python-liquid to version 2.2.1 or higher.

[,2.2.1)

Directory Traversal

python-liquid is an A Python engine for the Liquid template language.

Affected versions of this package are vulnerable to Directory Traversal via the FileSystemLoader and CachingFileSystemLoader components. An attacker can access and render arbitrary files outside the intended search path by supplying absolute paths through template tags. This is only exploitable if the targeted files contain valid markup and are readable by the application process.

How to fix Directory Traversal?

Upgrade python-liquid to version 2.2.0 or higher.

[,2.2.0)

Go back to all versions of this package