python-liquid
A Python engine for the Liquid template language.
Activity
- Latest release
- 5d ago
- Total releases
- 80
- Cadence
- ~15 days
- Last 12 months
- 10
Details
- License
- MIT
- First release
- Oct 15, 2020
| Version | Released | |
|---|---|---|
2.3.6
patch
|
2.3.6
patch
Dependencies (5)
|
|
2.3.5
patch
|
2.3.5
patch
Dependencies (5)
|
|
2.3.4
patch
|
2.3.4
patch
Dependencies (5)
|
|
2.3.3
patch
|
2.3.3
patch
Dependencies (5)
|
|
2.3.2
patch
|
2.3.2
patch
Dependencies (5)
|
|
2.3.1
patch
|
2.3.1
patch
Dependencies (5)
|
|
2.3.0
minor
|
2.3.0
minor
Dependencies (4)
|
|
2.2.2
patch
|
2.2.2
patch
Dependencies (4)
|
|
2.2.1
patch
|
2.2.1
patch
Dependencies (4)
|
|
2.2.0
minor
1 CVE
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev |
2.2.0
minor
Dependencies (4)
|
|
2.1.0
minor
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
2.1.0
minor
Dependencies (4)
|
|
2.0.2
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
2.0.2
patch
Dependencies (4)
|
|
2.0.1
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
2.0.1
patch
Dependencies (4)
|
|
2.0.0
major
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
2.0.0
major
Dependencies (4)
|
|
1.13.0
minor
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.13.0
minor
Dependencies (4)
|
|
1.12.2
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.12.2
patch
Dependencies (4)
|
|
1.12.1
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.12.1
patch
Dependencies (4)
|
|
1.12.0
minor
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.12.0
minor
Dependencies (4)
|
|
1.11.0
minor
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.11.0
minor
Dependencies (4)
|
|
1.10.2
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.10.2
patch
Dependencies (3)
|
|
1.10.0
minor
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.10.0
minor
Dependencies (3)
|
|
1.9.4
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.9.4
patch
Dependencies (3)
|
|
1.9.3
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.9.3
patch
Dependencies (3)
|
|
1.9.2
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.9.2
patch
Dependencies (3)
|
|
1.9.1
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.9.1
patch
Dependencies (3)
|
|
1.9.0
minor
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.9.0
minor
Dependencies (3)
|
|
1.8.1
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.8.1
patch
Dependencies (3)
|
|
1.8.0
minor
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.8.0
minor
Dependencies (3)
|
|
1.7.0
minor
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.7.0
minor
Dependencies (3)
|
|
1.6.1
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.6.1
patch
Dependencies (3)
|
|
1.6.0
minor
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.6.0
minor
Dependencies (3)
|
|
1.5.1
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.5.1
patch
Dependencies (3)
|
|
1.5.0
minor
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.5.0
minor
Dependencies (3)
|
|
1.4.7
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.4.7
patch
Dependencies (3)
|
|
1.4.6
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.4.6
patch
Dependencies (3)
|
|
1.4.5
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.4.5
patch
Dependencies (3)
|
|
1.4.4
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.4.4
patch
Dependencies (3)
|
|
1.4.3
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.4.3
patch
Dependencies (3)
|
|
1.4.2
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.4.2
patch
Dependencies (3)
|
|
1.4.1
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.4.1
patch
Dependencies (3)
|
|
1.4.0
minor
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.4.0
minor
Dependencies (3)
|
|
1.3.0
minor
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.3.0
minor
Dependencies (3)
|
|
1.2.1
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.2.1
patch
Dependencies (3)
|
|
1.2.0
minor
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.2.0
minor
Dependencies (2)
|
|
1.1.7
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.1.7
patch
Dependencies (2)
|
|
1.1.6
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.1.6
patch
Dependencies (2)
|
|
1.1.5
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.1.5
patch
Dependencies (2)
|
|
1.1.4
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.1.4
patch
Dependencies (2)
|
|
1.1.3
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.1.3
patch
Dependencies (2)
|
|
1.1.2
patch
2 CVEs
CVE-2026-55865
PYSEC-2026-3035
GHSA-vq2f-vcc9-j8mv
Jul 13, 2026
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Medium
Network
Low
Low
None
ImpactGiven a malformed PatchesThe issue is fixed in version 2.2.1 with the correction of the WorkaroundsManually correct the definition of Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 59 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
Fixed in
2.2.1
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-45017
PYSEC-2026-192
GHSA-8p4x-wr7x-3788
May 28, 2026
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0. Affected versions
0.10.0
0.10.1
0.11.0
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
+ 58 more Show less
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.1
2.0.2
2.1.0
Fixed in
2.2.0
Updated Jun 03, 2026 · Source: OSV.dev |
1.1.2
patch
Dependencies (2)
|