CVE-2026-106120: LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration
LiquidJS’s ownPropertyOnly option is intended to prevent templates from reading inherited or prototype properties from scope data.
With ownPropertyOnly: true, direct access such as:
{{ a[0] }}
correctly blocks an inherited array index. However, the same inherited value is still disclosed through:
.first
.last
negative indexing
for-loop iteration
first
last
join
reverse
slice
compact
References
- github.com/advisories/GHSA-fwxr-j5w2-587m
- github.com/harttle/liquidjs/commit/552819a84b80c62306fe61072628a756272dc749
- github.com/harttle/liquidjs/pull/924
- github.com/harttle/liquidjs/releases/tag/v10.27.2
- github.com/harttle/liquidjs/security/advisories/GHSA-fwxr-j5w2-587m
- nvd.nist.gov/vuln/detail/CVE-2026-106120
Code Behaviors & Features
Detect and mitigate CVE-2026-106120 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →