pypi package report

Is python-liquid safe?

2 known vulnerabilities, worst severity HIGH.

cvss
8.2

how bad it is if exploited, out of 10

epss
0.30%

chance of exploitation in the next 30 days

xyz score
4.0

CyberXYZ composite, out of 10

fig. 01 — GHSA-8p4x-wr7x-3788, the advisory selected below

// advisories

GHSA-8p4x-wr7x-3788

HIGHCVE-2026-45017

The built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process.

Affected
< 2.2.0
Fixed in
2.2.0
Weakness
CWE-22
Published
2026-05-11
Source
github

GHSANVDMITREreferencereference

// dependencies

5 direct, 1 carrying known advisories, worst HIGH

Sign in for dependency paths and remediation

// ai model usage

No published models are known to use this package.

Checked 2026-09-22 at 01:29 UTC. The most recent advisory here was published 2026-06-19. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.
Is python-liquid safe? pypi package security report | CyberXYZ