A critical code injection vulnerability in LiquidJS allows unauthenticated attackers to achieve remote code execution through malicious template input.

This vulnerability is a code injection flaw (CWE-94) stemming from improper handling of user-supplied template data. The vulnerability is exploitable by an unauthenticated attacker over the network.

Successful exploitation grants an attacker the ability to execute arbitrary code within the context of the application, leading to a full system compromise. Given the CVSS score of 10.0, this represents the highest level of risk, potentially resulting in complete loss of data confidentiality, integrity, and system availability.

Immediate Action: Update the liquidjs package to version 10.26.0 or later immediately to incorporate the vendor-provided patch.

Proactive Monitoring: Monitor application logs for unexpected template execution patterns or unusual server-side activity that may indicate attempts to inject malicious code.

Compensating Controls: Implement strict input validation or sandboxing for any user-provided templates to prevent the processing of malicious payloads before the patch can be applied.

Public Exploit Available: Unknown.

This vulnerability poses a critical risk to any infrastructure utilizing the LiquidJS engine. Organizations should prioritize patching this dependency across all development and production environments immediately to prevent potential remote code execution attacks.