Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Given a malformed {% case %} tag without associated {% when %} or {% else %} block, and no terminating {% endcase %} tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. Patches The issue is fixed in version 2.2.1 with the correction of the liquid.TokenStream.eof attribute. The kind and value of the special EOF token are now the same, so either can be tested against liquid.token.TOKENEOF. Workarounds Manually correct the definition of liquid.TokenStream.eof before parsing any templates.
Recommended action: Upgrade to 2.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. Patches The issue is fixed in version 2.2.0 with the inclusion of a templatepath.isabsolute() condition in liquid/builtin/loaders/filesystemloader.py. Workarounds Create a custom template loader by inheriting from FileSystemLoader and overriding resolvepath(). Use an instance of the custom loader as the loader argument when instantiating your Liquid environment.
Recommended action: Upgrade to 2.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.