# CVE-2026-45618: CVE-2026-45618: LiquidJS Template Injection RCE

> CVE-2026-45618 is a critical-severity remote code execution issue in liquidjs, a package.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-45618
- **Aliases:** ti-042
- **Severity:** critical
- **Attack type:** Remote code execution
- **Component:** liquidjs (package)
- **Package:** liquidjs (npm)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-06-02
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-45618

## Summary

A critical remote-code-execution flaw in the npm package LiquidJS lets attackers execute arbitrary code by supplying specially crafted templates that abuse internal object references and function-invocation mechanisms. Any service that renders untrusted LiquidJS templates is at risk.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| see advisory | no fixed version listed |

## Am I affected by CVE-2026-45618?

You are affected if liquidjs is installed or configured on a machine. Check the references for the exact versions.

## How do I fix CVE-2026-45618?

Upgrade LiquidJS to a patched release and never render user-supplied templates without sandboxing. Audit apps that accept template input from untrusted sources.

## References

- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-45618

## Related vulnerabilities

- [CVE-2026-88066](https://catalog.anomity.ai/vuln/cve-2026-88066) — high
- [CVE-2026-102437](https://catalog.anomity.ai/vuln/cve-2026-102437) — high
- [CVE-2026-90999](https://catalog.anomity.ai/vuln/cve-2026-90999) — critical
- [CVE-2026-87987](https://catalog.anomity.ai/vuln/cve-2026-87987) — critical
- [CVE-2026-114090](https://catalog.anomity.ai/vuln/cve-2026-114090) — high
- [CVE-2026-115419](https://catalog.anomity.ai/vuln/cve-2026-115419) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-45618