CVE-2026-39412: 
JavaScript vulnerability analysis and mitigation

CVE-2026-39412 is an information disclosure vulnerability in LiquidJS, a Shopify/GitHub Pages compatible JavaScript template engine, where the sort_natural (and sort) filter bypasses the ownPropertyOnly security option. This allows template authors to extract values of prototype-inherited properties — such as API keys and tokens — through a sorting side-channel attack. All versions prior to 10.25.4 are affected. The vulnerability was disclosed on April 8, 2026, and carries a CVSS v3.1 base score of 7.5 (High) per NVD, or 5.3 (Moderate) per the GitHub Security Advisory (GitHub Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In src/filters/array.ts, the sort_natural function accessed object properties using direct JavaScript bracket notation (lhs[propertyString]), which traverses the full prototype chain without checking hasOwnProperty. This bypasses the readJSProperty function in src/context/context.ts, which correctly enforces the ownPropertyOnly guard. The fix (PR #869) refactored both sort and sort_natural to use _getFromScope, which respects the ownPropertyOnly setting, and introduced a shared sortBy helper. A public proof-of-concept is included in the security advisory demonstrating character-by-character secret extraction via binary search on sort order (GitHub Advisory, Fix Commit).

Successful exploitation enables unauthorized template authors to read prototype-inherited sensitive properties — including API keys, tokens, and passwords — from context objects passed to the LiquidJS engine. The attack is particularly impactful in multi-tenant template systems where ownPropertyOnly: true is used as a security boundary to isolate tenant-controlled templates from server-side data. There is no integrity or availability impact; the vulnerability is purely a confidentiality concern, but credential exposure could enable further privilege escalation or lateral movement (GitHub Advisory).

A public proof-of-concept exploit is available in the GitHub Security Advisory, demonstrating the attack with a standalone, runnable JavaScript script. The exploit requires no authentication and no user interaction — only the ability to author or inject templates in a LiquidJS-powered application. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.029% (very low probability of exploitation in the near term) (GitHub Advisory).

1. Identify target: Locate a multi-tenant application using LiquidJS with ownPropertyOnly: true where untrusted users can write or submit Liquid templates (e.g., a SaaS platform with user-customizable email or page templates).
2. Understand the target object: Determine what prototype-inherited properties (e.g., apiKey, token) may be present on context objects passed to the template engine. This may require prior reconnaissance of the application's data model.
3. Craft a sorting probe template: Create a Liquid template that uses sort_natural with the target property name and includes known "probe" objects with known property values to bracket the secret:

   {% assign sorted = users | sort_natural: "apiKey" %}{% for u in sorted %}{{ u.name }},{% endfor %}

4. Infer secret value via side-channel: Submit the template with probe objects whose apiKey values straddle the expected range (e.g., aaa and zzz). Observe the sort order of the output — the position of the target object relative to the probes reveals whether its prototype apiKey falls between the probe values.
5. Binary search for full secret: Iteratively narrow the probe values (e.g., aaa/mmm, then mmm/zzz) to extract the secret character-by-character through repeated template submissions, reconstructing the full value (GitHub Advisory).

• Logs: Repeated template rendering requests containing sort_natural or sort filters with sensitive property names (e.g., apiKey, token, password, secret) as arguments; high volume of similar template submissions with incrementally varying probe values suggesting automated binary search.
• Application Behavior: Unexpected or anomalous sort ordering in template output that does not match own-property data; template submissions from a single user that systematically vary a single parameter across many requests.
• Network: Unusual frequency of API calls or template submission endpoints from a single source IP, particularly if the application exposes a template preview or rendering endpoint.

Upgrade LiquidJS to version 10.25.4 or later, which fixes both the sort_natural and sort filters to use _getFromScope for property access, correctly enforcing the ownPropertyOnly security option (LiquidJS Release, Fix Commit). There is no known configuration-based workaround short of upgrading; disabling user-authored templates entirely would mitigate the risk but is not practical for most deployments. Applications in multi-tenant environments using ownPropertyOnly: true as a security boundary should treat this update as high priority.

The vulnerability was reported by researcher tndud042713 and credited in the GitHub Security Advisory. The fix was merged by the LiquidJS maintainer (harttle) on April 7, 2026, with the patched release (v10.25.4) published the same day. Community reaction on GitHub was modest, with a small number of reactions on the release noting the fix (LiquidJS Release, GitHub Advisory).