CVE-2026-39859

OVERVIEW CVE-2026-39859 is a path traversal vulnerability in LiquidJS, a JavaScript-based template engine compatible with Shopify and GitHub Pages. Versions prior to 10.25.3 fail to properly enforce document root boundaries during top-level file loads, allowing attackers to read arbitrary files from the server filesystem when a LiquidJS instance is configured with an empty temporary directory as root. The vulnerability affects the renderFile() and parseFile() methods. SEVERITY This vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction, making it easily exploitable from remote sources. The attack has low complexity and results in high confidentiality impact through unauthorized file disclosure, though integrity and availability are not affected. The FAUCET risk score of 48.0/100 indicates moderate concern, with the EPSS score of 0.00019 suggesting minimal real-world exploitation activity to date. EXPLOITATION STATUS The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation in the wild. No public exploit code is readily available, and community attention appears limited given its inactive status on threat intelligence platforms. Organizations using LiquidJS should prioritize patching to version 10.25.3 to mitigate potential future exploitation.