CVE-2022-25948: Liquidjs

Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days.

The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided.

Affected products

• Liquidjs Liquidjs: before 10.0.0 (fixed in 10.0.0)

Published 2022-12-22. Last modified 2026-06-17.