CVE-2026-45618: LiquidJS Template Injection RCE
CVE-2026-45618 is a critical-severity remote code execution issue in liquidjs, a package.
Is liquidjs running on your developers' machines? Anomity inventories the AI agents, MCP servers, extensions and skills on every developer device, so you can see what this advisory touches. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2026-45618- Severity
- critical
- Attack type
- Remote code execution
- Component
- liquidjs · package
- Package
liquidjsnpm- Known exploited
- No known exploitation
- Published
- Last verified
What is CVE-2026-45618?
A critical remote-code-execution flaw in the npm package LiquidJS lets attackers execute arbitrary code by supplying specially crafted templates that abuse internal object references and function-invocation mechanisms. Any service that renders untrusted LiquidJS templates is at risk.
Am I affected by CVE-2026-45618?
You are affected if liquidjs is installed or configured on a machine. Check the references for the exact versions.
How do I fix CVE-2026-45618?
Upgrade LiquidJS to a patched release and never render user-supplied templates without sandboxing. Audit apps that accept template input from untrusted sources.