---
title: "Critical RCE in LiquidJS Lets Attackers Execute Arbitrary Commands on Unpatched Hosts"
url: https://daily.dev/posts/critical-rce-in-liquidjs-lets-attackers-execute-arbitrary-commands-on-unpatched-hosts-80y8sp5mi
source_url: https://orca.security/resources/blog/critical-rce-in-liquidjs-lets-attackers-execute-arbitrary-commands-on-unpatched-hosts
type: article
source: "Orca Security Blog"
published: 2026-06-01T20:15:54.903Z
updated: 2026-06-01T20:16:17.423Z
tags: ["security", "nodejs"]
reading_time: 3
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Critical RCE in LiquidJS Lets Attackers Execute Arbitrary Commands on Unpatched Hosts

**[Orca Security Blog](https://daily.dev/sources/orca-security-blog)** · 3 min read · 0 upvotes · 0 comments

## Summary

A critical RCE vulnerability (CVE-2026-45618, CVSS 10.0) has been disclosed in LiquidJS, a Node.js Liquid template engine with over 7.3 million monthly npm downloads. The flaw stems from improper input handling in filter evaluation logic, allowing attackers to access internal JavaScript execution contexts via the valueOf filter, chain prototype manipulation to reach the Function constructor, and execute arbitrary commands — all without authentication. A public proof-of-concept exists demonstrating file reads and command execution via child_process.execSync. All LiquidJS versions prior to 10.26.0 are affected. Immediate upgrade to 10.26.0 is recommended; if patching is not possible, restrict template input from untrusted sources. Successful exploitation can lead to full host compromise, lateral movement, and data exfiltration.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://orca.security/resources/blog/critical-rce-in-liquidjs-lets-attackers-execute-arbitrary-commands-on-unpatched-hosts>

---

Tags: [#security](https://daily.dev/tags/security), [#nodejs](https://daily.dev/tags/nodejs)

[View this post on daily.dev](https://daily.dev/posts/critical-rce-in-liquidjs-lets-attackers-execute-arbitrary-commands-on-unpatched-hosts-80y8sp5mi)