Topic starter
09/06/2026 11:19 pm
TL;DR: LiquidJS CVE-2026-45618 lets attackers reach arbitrary JavaScript execution through crafted template input, with public exploit code already demonstrating file reads and command execution, according to Orca Security. The issue turns template rendering into a host-compromise path, so dependency exposure and untrusted content handling now matter as much as patching.
Editorial analysis by NHI Mgmt Group, based on content published by Orca Security: “Critical RCE in LiquidJS Lets Attackers Execute Arbitrary Commands on Unpatched Hosts”.
By the numbers:
- LiquidJS had over 7.3 million monthly npm downloads when CVE-2026-45618 was disclosed.
- CVE-2026-45618 was assigned CVSS 10.0.
Key questions
Q: What should teams do first when a template engine can execute attacker-controlled input?
A: The first move is to remove untrusted template paths and patch the vulnerable engine everywhere it runs.
Q: Why do template-engine flaws create host compromise risk instead of staying inside the app?
A: Because once rendering reaches internal execution contexts, the attacker is no longer limited to formatting output.
Q: What are the signs that a Node.js template service is exposed to dangerous input paths?
A: Look for services that render partner content, CMS fields, notification templates, or user-supplied expressions without strict separation between data and template syntax.
Practitioner guidance
- Patch to LiquidJS 10.26.0 or later Upgrade every direct and transitive deployment of liquidjs to version 10.26.0 or later, then verify that build artifacts, containers, and serverless packages no longer ship the vulnerable release.
- Restrict attacker-controlled template input Block user-controlled or partner-controlled template fragments from reaching LiquidJS until the update is deployed, and separate content fields from executable template syntax in application flows.
- Map runtime reachability for template services Identify which Node.js services render Liquid templates and record whether they can reach secrets, local files, internal APIs, or command execution primitives.
Bottom line: LiquidJS CVE-2026-45618 turns crafted template input into arbitrary JavaScript execution, which means the application boundary is weaker than many teams assume.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 20 hours ago by NHI Mgmt Group
10/06/2026 1:37 am
Template evaluation is now a code-execution boundary, not a harmless rendering step. LiquidJS shows how quickly a templating engine can become a host compromise path when internal execution contexts are reachable from attacker-controlled input. That is an application-layer governance failure with identity consequences, because secrets, tokens, and runtime permissions often sit inside the same process. Practitioners should treat template rendering as a privileged execution surface, not a text-processing utility.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which shows how quickly hidden machine access can outgrow policy coverage.
A question worth separating out:
Q: Who is accountable when a template engine flaw leads to host compromise?
A: Application owners, platform teams, and vulnerability management all share accountability because the flaw spans code, runtime, and dependency governance. The response obligation is to remove exploitable exposure, verify dependency versions, and confirm that no sensitive secrets remain reachable from the affected process.
👉 Read our full editorial: LiquidJS RCE exposes the limits of template trust in Node.js
11/06/2026 12:41 am
Template evaluation is now a code-execution boundary, not a harmless rendering step. LiquidJS shows how quickly a templating engine can become a host compromise path when internal execution contexts are reachable from attacker-controlled input. That is an application-layer governance failure with identity consequences, because secrets, tokens, and runtime permissions often sit inside the same process. Practitioners should treat template rendering as a privileged execution surface, not a text-processing utility.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which shows how quickly hidden machine access can outgrow policy coverage.
A question worth separating out:
Q: Who is accountable when a template engine flaw leads to host compromise?
A: Application owners, platform teams, and vulnerability management all share accountability because the flaw spans code, runtime, and dependency governance. The response obligation is to remove exploitable exposure, verify dependency versions, and confirm that no sensitive secrets remain reachable from the affected process.
👉 Read our full editorial: LiquidJS RCE exposes the limits of template trust in Node.js
12/06/2026 2:15 am
Template engines are execution surfaces, not safe text processors: CVE-2026-45618 shows that template trust assumptions fail when rendering logic can reach runtime objects and constructors. The issue is not just about a vulnerable package, but about allowing untrusted input to cross from content handling into interpreter state. Practitioners should treat template rendering as an execution boundary that deserves the same scrutiny as deserialisation and command invocation.
A question worth separating out:
Q: How should security teams contain the impact of template execution bugs in production?
A: Place rendering workloads in tightly scoped runtime environments with minimal file, network, and secret access. If compromise occurs, the attacker should not be able to pivot from template execution into credentials, internal services, or privileged operating-system actions.
👉 Read our full editorial: LiquidJS RCE exposes the limits of template trust in Node.js
This post was modified 20 hours ago by NHI Mgmt Group