Medium severity · published Dec 22, 2022
CVE-2022-25948
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype
5.3
CVSS
1%
EPSS
No
On KEV
Description
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Liquidjs · Liquidjs
before 10.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-25948
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-25948
Patch
https://github.com/harttle/liquidjs/commit/7e99efc5131e20cf3f59e1fc2c371a15aa4109db
Patch
https://github.com/harttle/liquidjs/commit/7eb621601c2b05d6e379e5ce42219f2b1f556208
Exploit
https://github.com/harttle/liquidjs/issues/454
Broken Link
https://groups.google.com/u/0/a/snyk.io/g/report/c/9ipXecWRtTM/m/IgLadevtCQAJ
Exploit
https://security.snyk.io/vuln/SNYK-JS-LIQUIDJS-2952868
More from Liquidjs
7.5
CVE-2026-39859
LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read
7.5
CVE-2026-39412
LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
7.5
CVE-2026-35525
LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates
7.5
CVE-2026-33285
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
7.5
CVE-2026-33287
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern