CVE-2026-39859: 
JavaScript vulnerability analysis and mitigation

CVE-2026-39859 is a path traversal vulnerability in LiquidJS, a Shopify/GitHub Pages compatible template engine written in pure JavaScript. The flaw allows a Liquid instance configured with a restricted root directory to read arbitrary files from the server's file system via the renderFile() and parseFile() APIs, bypassing the intended sandbox boundary. It affects LiquidJS versions prior to 10.25.3 (with 10.25.0 confirmed vulnerable), and was disclosed on April 8, 2026, with a fix released in version 10.25.5 on April 7, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). In src/fs/loader.ts, the lookup() function previously set enforceRoot = type !== LookupType.Root, meaning that for top-level file loads (LookupType.Root), the contains() boundary check was skipped entirely. This allowed absolute paths such as /etc/hosts to be resolved and read without verifying they reside within the configured root directory. The vulnerability is exploitable remotely with no authentication or user interaction required, provided the application forwards attacker-controlled template names into renderFile() or parseFile(). This issue is adjacent to the March 2026 fix for CVE-2026-30952, which hardened include/render/layout partial lookups but left top-level file-loading APIs unprotected (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files accessible to the server process, including sensitive resources such as /etc/hosts, application configuration files, private keys, environment files, and source code. The confidentiality impact is high, while integrity and availability are unaffected. Applications that treat the LiquidJS root option as a sandbox boundary and accept attacker-controlled template names are directly at risk of significant information disclosure (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.063%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no privileges or user interaction and is network-accessible, making it straightforward to exploit in applications that pass user-controlled input to renderFile() or parseFile().

1. Reconnaissance: Identify web applications using LiquidJS versions prior to 10.25.3 (e.g., by inspecting package.json, npm audit output, or HTTP response headers/error messages that reveal the template engine).
2. Identify injection point: Locate application endpoints that accept user-supplied template names and pass them directly to engine.renderFile() or engine.parseFile() without sanitization.
3. Craft malicious request: Submit an absolute file path as the template name, such as /etc/hosts, /etc/passwd, or application-specific paths like /app/.env or /app/config/secrets.json.
4. Trigger file read: The vulnerable lookup() function in src/fs/loader.ts skips the contains() boundary check for LookupType.Root, resolves the absolute path, and reads the file contents.
5. Retrieve sensitive data: The file contents are returned in the HTTP response as rendered template output, exposing credentials, private keys, or other sensitive data to the attacker (GitHub Advisory, Fix Commit).

• Network: Unusual HTTP requests to template-rendering endpoints containing absolute file paths (e.g., /etc/passwd, /etc/hosts, /.env, /proc/self/environ) as template name parameters.
• Logs: Application or web server access logs showing requests with absolute path strings in template name fields; Node.js application logs showing file reads from outside the configured root directory.
• File System: No direct file system artifacts are created by exploitation, but audit logs (if enabled) may show unexpected file reads by the Node.js process from sensitive directories.
• Process: Node.js process accessing files outside the expected application directory tree, observable via system call tracing tools such as strace or auditd rules on sensitive paths like /etc/, /root/, or application secret directories.

Upgrade LiquidJS to version 10.25.5 (or at minimum 10.25.3), which enforces the same contains() root containment check for LookupType.Root lookups as is applied to partial/layout lookups (GitHub Release, Fix PR). As an interim workaround, applications should validate and sanitize any user-supplied template names before passing them to renderFile() or parseFile(), rejecting absolute paths and path traversal sequences. Additionally, run the Node.js application process with the minimum file system permissions necessary to limit the blast radius of any exploitation.

The vulnerability was reported by security researcher Ryu7zz and credited in the GitHub Security Advisory. The fix was implemented by the repository maintainer (harttle) using Cursor AI assistance and merged on April 7, 2026, one day before the advisory was published (GitHub Advisory, Fix PR). Red Hat also tracked the CVE in their security database. No significant broader media coverage or social media discussion has been observed beyond standard vulnerability aggregator entries.