A vulnerability in the LiquidJS template engine allows unauthenticated attackers to cause a denial of service through an infinite loop condition.

This is an infinite loop vulnerability (CWE-835) occurring within the template processing logic. An unauthenticated attacker can supply specifically crafted input that prevents the engine from reaching a termination condition, exhausting system resources.

The vulnerability carries a CVSS score of 8.7, reflecting its high impact on system availability. Successful exploitation results in a denial of service, rendering the affected application unresponsive to legitimate users and potentially causing significant operational downtime for services relying on this template engine.

Immediate Action: Update the LiquidJS package to version 10.27.1 or later to incorporate the necessary fix for the infinite loop condition.

Proactive Monitoring: Monitor application logs for spikes in CPU usage or unusually long response times associated with template rendering functions.

Compensating Controls: Implement request rate limiting or timeouts on services that process user-supplied templates to mitigate the impact of potential resource exhaustion attacks.

Public Exploit Available: Unknown.

Given the high severity of this denial of service vulnerability, organizations using LiquidJS should prioritize updating their dependencies immediately. Ensuring the engine is patched to version 10.27.1 will eliminate the underlying logic flaw and restore service stability.