CVE-2026-44644 Overview
CVE-2026-44644 is a Cross-Site Scripting (XSS) vulnerability in LiquidJS, a Shopify and GitHub Pages compatible template engine written in pure JavaScript. The flaw affects versions 10.25.7 and below, where the strip_html filter fails to remove HTML tags containing newline characters. Applications that rely on strip_html as an XSS sanitizer without additional HTML escaping pass attacker-controlled markup directly to the browser. The issue is tracked as [CWE-79] and has been resolved in version 10.26.0.
Critical Impact
Attackers can bypass the strip_html sanitization filter by inserting newline characters inside HTML tags, enabling arbitrary JavaScript execution in the victim's browser context.
Affected Products
- LiquidJS versions 10.25.7 and earlier
- Applications using {{ x | strip_html }} to sanitize attacker-controlled input
- Deployments where outputEscape remains unset (the default configuration)
Discovery Timeline
- 2026-06-17 - CVE-2026-44644 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-44644
Vulnerability Analysis
The strip_html filter in LiquidJS removes HTML tags from a string before rendering and is widely used as an XSS sanitizer. The filter relies on a regular expression whose catch-all branch <.*?> does not match line terminators by default in JavaScript regex semantics. Any HTML tag containing a \n or \r character passes through the filter unmodified.
Browsers, however, treat newlines as whitespace inside tag declarations. A payload such as <img\nsrc=x\nonerror=alert(1)> survives sanitization intact and executes the onerror handler when rendered. The defect is exploitable in applications that render attacker-controlled strings using {{ x | strip_html }} to defend against HTML injection and rely on the filter exclusively, because outputEscape is not enabled by default.
Root Cause
The root cause is incomplete pattern coverage in the regex used by strip_html. The dot metacharacter in JavaScript regular expressions excludes line terminators unless the s (dotAll) flag is set. The implementation did not account for tags split across multiple lines, producing a sanitization gap directly exploitable for stored or reflected XSS [CWE-79].
Attack Vector
An attacker submits input containing an HTML tag with embedded newline characters into any field whose value is later rendered through strip_html. When the template engine outputs the filtered string into an HTML context, the browser parses the surviving tag and executes any event handler attributes. Exploitation requires user interaction with the affected page and operates across a network attack vector. The vulnerability scope changes because injected script runs in the trust context of the application serving the rendered template.
For technical details, see the GitHub Security Advisory GHSA-2qv6-9wx5-cwv4 and the fix commit.
Detection Methods for CVE-2026-44644
Indicators of Compromise
- Stored user input containing HTML tags with embedded \n or \r characters, particularly <img>, <svg>, or <iframe> constructs split across multiple lines.
- Outbound requests to attacker-controlled domains originating from rendered template pages.
- Web application logs showing POST or form submissions with URL-encoded %0A or %0D sequences inside HTML-like payloads.
Detection Strategies
- Scan template usage for | strip_html filter chains that are not followed by an explicit HTML escape filter.
- Audit dependency manifests (package.json, package-lock.json, yarn.lock) for liquidjs versions at or below 10.25.7.
- Apply web application firewall rules that flag HTML tags containing CRLF byte sequences within request bodies and query strings.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting endpoints to capture inline script violations triggered by injected handlers.
- Monitor JavaScript runtime errors and CSP report-only logs for anomalous event handler executions across rendered pages.
- Track outbound traffic from browsers loading rendered LiquidJS templates for unexpected destinations indicative of data exfiltration.
How to Mitigate CVE-2026-44644
Immediate Actions Required
- Upgrade LiquidJS to version 10.26.0 or later across all applications and build pipelines.
- Inventory all template files referencing strip_html and verify each is paired with an HTML escape filter such as escape.
- Enable the outputEscape engine option globally so default rendering escapes HTML metacharacters.
Patch Information
The maintainer fixed the regex in the GitHub commit 26ea2856, released as part of LiquidJS v10.26.0. The patch updates the tag-matching regex so newline characters inside HTML tags are also stripped, restoring the filter's intended behavior.
Workarounds
- Chain strip_html with an additional HTML escape filter, for example {{ x | strip_html | escape }}, until upgrading is feasible.
- Apply server-side input validation that rejects payloads containing CR or LF characters inside angle-bracket sequences.
- Deploy a strict CSP that disallows inline event handlers and inline scripts to limit the impact of any surviving injection.
# Configuration example
npm install liquidjs@^10.26.0
npm ls liquidjs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
