CVE-2026-61556: LiquidJS has an infinite loop vulnerability in its `strip_html` filter
The current implementation of strip_html can cause an infinite loop when the input string contains <, has at least one character before <, and no > appears after <.
References
- github.com/advisories/GHSA-m7fp-h3p4-hr49
- github.com/harttle/liquidjs/commit/5c3522f33928aae66f0fe85c36e1d9015c768fe2
- github.com/harttle/liquidjs/pull/917
- github.com/harttle/liquidjs/releases/tag/v10.27.1
- github.com/harttle/liquidjs/security/advisories/GHSA-m7fp-h3p4-hr49
- nvd.nist.gov/vuln/detail/CVE-2026-61556
Code Behaviors & Features
Detect and mitigate CVE-2026-61556 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →