Improperly Implemented Security Check for Standard Affecting liquidjs package, versions <10.25.4
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-LIQUIDJS-15930991
- published8 Apr 2026
- disclosed8 Apr 2026
- creditByunSuyoung
Introduced: 8 Apr 2026
NewCVE-2026-39412 (opens in a new tab)How to fix?
Upgrade liquidjs to version 10.25.4 or higher.
Overview
liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript.
Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard via the sort_natural and sort filters, which bypass the iownPropertyOnly security option by accessing prototype-inherited properties even when a security option is enabled. An attacker can extract sensitive information from prototype properties by manipulating the sorting process to reveal the values through side-channel analysis.