LiquidJS's ownPropertyOnly let array filters read inherited values; a Cursor-assisted 10.27.2 fix closed only some routes, and join, reverse, slice, compact and loops still leak.

How AI contributed: Flawed AI-written codePublished Oct 7, 2026 in harttle/liquidjs

Provisional finding. Full causal and release verification remains incomplete.

What actually happened

From 9.34.0 to 10.27.1, human-written code applied ownPropertyOnly only to direct property reads, so filters and loops exposed polluted Array.prototype entries. The AI-co-authored 10.27.2 fix closed indexing and first/last only; a test run shows the other routes still leak in 10.27.2 to 10.30.0 and 11.0.0-alpha.1, with no fix yet.

AI-assisted change

The AI-co-authored change is an incomplete remediation of a human-written flaw: it routes only first and last through readArrayElement with ownPropertyOnly, while join, reverse, slice, compact, and iteration still use ordinary array semantics.

Root cause

Residual filter routes still expose inherited indices

Because ownPropertyOnly remains unapplied to those other filter and loop paths, polluted Array.prototype entries can still appear in rendered output in affected versions.

AI-assisted change: Cursor

7403bc2c87

src/filters/array.ts

Fix

Fix in 10.27.2 is incomplete

The 10.27.2 release the advisory calls fixed closes only indexing and first/last. With ownPropertyOnly on, join, reverse, slice, compact, and for or tablerow loops still render polluted Array.prototype entries in 10.27.2 to 10.30.0 and 11.0.0-alpha.1, and no later fix exists.

Fix authorship not yet analyzed

552819a84b

src/filters/array.ts

Case facts

CVE ID: CVE-2026-106120
GHSA ID: GHSA-FWXR-J5W2-587M
Published: Oct 7, 2026
Severity: Not scored
Language: TypeScript
AI tool: Cursor
AI role: Flawed AI-written code
Root cause: Other or unclear
Vulnerable release: 9.34.0 through 10.27.1; 10.27.2 through 10.30.0 and 11.0.0-alpha.1 still leak through join, reverse, slice, compact and loops

Advisory source Suggest a correction

Cite this finding

Vibe Security Radar, "CVE-2026-106120 in harttle/liquidjs," Georgia Tech SSLab, https://vibesecradar.com/cves/CVE-2026-106120/

AI-assisted change

AI-assisted changesrc/filters/array.ts source harttle/liquidjs@7403bc2c87+7−3

@@ -1,4 +1,4 @@-import { toArray, argumentsToValue, toValue, stringify, caseInsensitiveCompare, orderedCompare, isArray, isNil, last as arrayLast, isArrayLike, toEnumerable } from '../util'+import { toArray, argumentsToValue, toValue, stringify, caseInsensitiveCompare, orderedCompare, isArray, isNil, isArrayLike, readArrayElement, toEnumerable } from '../util' import { arrayIncludes, equals, evalToken, isTruthy } from '../render' import { Value, FilterImpl } from '../template' import { Tokenizer } from '../parser'

Show 4 hidden lines

@@ -12,8 +12,12 @@ export const join = argumentsToValue(function (this: FilterImpl, v: any[], arg:   this.context.memoryLimit.use(complexity)   return array.join(sep) })

-export const last = argumentsToValue((v: any) => isArrayLike(v) ? arrayLast(v) : '')-export const first = argumentsToValue((v: any) => isArrayLike(v) ? v[0] : '')+export const last = argumentsToValue(function (this: FilterImpl, v: any) {+  return isArrayLike(v) ? readArrayElement(v, -1, this.context.ownPropertyOnly) : ''+})+export const first = argumentsToValue(function (this: FilterImpl, v: any) {+  return isArrayLike(v) ? readArrayElement(v, 0, this.context.ownPropertyOnly) : ''+}) export const reverse = argumentsToValue(function (this: FilterImpl, v: any[]) {   const array = toArray(v)

Show 1 hidden lines

   this.context.memoryLimit.use(array.length)

The AI-co-authored change updates only the first and last filters to call readArrayElement with ownPropertyOnly. Other array filters and iteration paths still use ordinary array semantics, so inherited Array.prototype indices can continue to leak.

Security fix

Fixsrc/filters/array.ts source harttle/liquidjs@552819a84b+14−8

@@ -1,4 +1,4 @@-import { toArray, argumentsToValue, toValue, stringify, caseInsensitiveCompare, orderedCompare, isArray, isNil, last as arrayLast, isArrayLike, toEnumerable } from '../util'+import { toArray, argumentsToValue, toValue, stringify, caseInsensitiveCompare, orderedCompare, isArray, isNil, isArrayLike, readArrayElement, toEnumerable } from '../util' import { arrayIncludes, equals, evalToken, isTruthy } from '../render' import { Value, FilterImpl } from '../template' import { Tokenizer } from '../parser'

Show 2 hidden lines

@@ -10,10 +10,14 @@ export const join = argumentsToValue(function (this: FilterImpl, v: any[], arg:   const sep = isNil(arg) ? ' ' : stringify(arg)

   const complexity = array.length * (1 + sep.length)   this.context.memoryLimit.use(complexity)-  return array.join(sep)+  return Array.prototype.join.call(array, sep)+})+export const last = argumentsToValue(function (this: FilterImpl, v: any) {+  return isArrayLike(v) ? readArrayElement(v, -1, this.context.ownPropertyOnly) : ''+})+export const first = argumentsToValue(function (this: FilterImpl, v: any) {+  return isArrayLike(v) ? readArrayElement(v, 0, this.context.ownPropertyOnly) : '' })-export const last = argumentsToValue((v: any) => isArrayLike(v) ? arrayLast(v) : '')-export const first = argumentsToValue((v: any) => isArrayLike(v) ? v[0] : '')

Show 5 hidden lines

 export const reverse = argumentsToValue(function (this: FilterImpl, v: any[]) {   const array = toArray(v)   this.context.memoryLimit.use(array.length)@@ -66,14 +70,14 @@ export function * sum (this: FilterImpl, arr: Scope[], property?: string): Itera export function compact<T> (this: FilterImpl, arr: T[]) {

   const array = toArray(arr)   this.context.memoryLimit.use(array.length)-  return array.filter(x => !isNil(toValue(x)))+  return Array.prototype.filter.call(array, x => !isNil(toValue(x))) }  export function concat<T1, T2> (this: FilterImpl, v: T1[], arg: T2[] = []): (T1 | T2)[] {

Show 1 hidden lines

   const lhs = toArray(v)

   const rhs = toArray(arg)   this.context.memoryLimit.use(lhs.length + rhs.length)-  return lhs.concat(rhs)+  return Array.prototype.concat.call(lhs, rhs) }  export function push<T> (this: FilterImpl, v: T[], arg: T): T[] {

Show 3 hidden lines

@@ -110,7 +114,9 @@ export function slice<T> (this: FilterImpl, v: T[] | string, begin: number, leng   if (!isArray(v)) v = stringify(v)   begin = begin < 0 ? v.length + begin : begin

   this.context.memoryLimit.use(length)-  return v.slice(begin, begin + length)+  return isArray(v)+    ? Array.prototype.slice.call(v, begin, begin + length)+    : String.prototype.slice.call(v, begin, begin + length) }  function expectedMatcher (this: FilterImpl, expected: any): (v: any) => boolean {

Show 2 hidden lines

@@ -132,7 +138,7 @@ function * filter<T extends object> (this: FilterImpl, include: boolean, arr: T[     values.push(yield evalToken(token, this.context.spawn(item)))

   }   const matcher = expectedMatcher.call(this, expected)-  return arr.filter((_, i) => matcher(values[i]) === include)+  return Array.prototype.filter.call(arr, (_, i) => matcher(values[i]) === include) }  function * filter_exp<T extends object> (this: FilterImpl, include: boolean, arr: T[], itemName: string, exp: string): IterableIterator<unknown> {

The squash that shipped in 10.27.2 switches join, compact, concat, slice, and filter to Array.prototype or String.prototype calls and routes first/last through readArrayElement. Those calls still read inherited indices, so join, reverse, slice, compact, and loops keep leaking.

Patch fingerprints

AI-assisted change d18a92dded8457737ab7a459217bec98ea241b530fe9f3169bde44156858ab66 · Fix 6cf632308d447721294093166a17b0f42bc819dcf7706502f9e44ba689603b91

All 28 →

Codex- and OpenCode-assisted changes in Vitest 5 replaced Vite's default file deny list with a token-only list, so a running UI, API or Browser Mode server could serve .env files, keys and .git contents.
CVE-2026-112948Oct 21, 2026vitest-dev/vitestTypeScriptChatGPT/CodexDirect introductionOther or unclear
Coraza skipped body parsing for unusual Content-Type values; a Claude-co-authored 3.8.0 fix handled parameters but not duplicate headers or leading whitespace, which hid form fields until 3.8.1.
GHSA-W253-M66G-RX24Oct 8, 2026corazawaf/corazaGoClaudeFlawed AI-written codeOther or unclear
Coraza mis-split cookies with control bytes; a Claude-co-authored 3.8.0 fix trimmed them but dropped cookies whose name was only control bytes, letting a client hide a cookie value from rules.
GHSA-G4QM-M288-5CP9Oct 8, 2026corazawaf/corazaGoClaudeFlawed AI-written codeOther or unclear
Coraza's JSON flattening let colliding keys hide a nested value from WAF rules; a Claude-assisted 3.8.0 fix closed dotted-name collisions but left case-variant collisions open until 3.8.1.
GHSA-5GJ4-9GM7-2FX2Oct 8, 2026corazawaf/corazaGoClaudeFlawed AI-written codeOther or unclear
Coraza read a decoy multipart filename when filename* used an uncommon charset; Claude-co-authored 3.8.0 fixes checked continuations only when no plain filename* was present.
GHSA-3WR7-993Q-JRFFOct 8, 2026corazawaf/corazaGoClaudeFlawed AI-written codeOther or unclear

LiquidJS's ownPropertyOnly let array filters read inherited values; a Cursor-assisted 10.27.2 fix closed only some routes, and join, reverse, slice, compact and loops still leak.

How AI contributed: Flawed AI-written codePublished Oct 7, 2026 in harttle/liquidjs

Provisional finding. Full causal and release verification remains incomplete.

What actually happened

AI-assisted change

Root cause

Residual filter routes still expose inherited indices

Because ownPropertyOnly remains unapplied to those other filter and loop paths, polluted Array.prototype entries can still appear in rendered output in affected versions.

AI-assisted change: Cursor

7403bc2c87

src/filters/array.ts

Fix

Fix in 10.27.2 is incomplete

Fix authorship not yet analyzed

552819a84b

src/filters/array.ts

Case facts

CVE ID: CVE-2026-106120
GHSA ID: GHSA-FWXR-J5W2-587M
Published: Oct 7, 2026
Severity: Not scored
Language: TypeScript
AI tool: Cursor
AI role: Flawed AI-written code
Root cause: Other or unclear
Vulnerable release: 9.34.0 through 10.27.1; 10.27.2 through 10.30.0 and 11.0.0-alpha.1 still leak through join, reverse, slice, compact and loops

Advisory source Suggest a correction

Cite this finding

Vibe Security Radar, "CVE-2026-106120 in harttle/liquidjs," Georgia Tech SSLab, https://vibesecradar.com/cves/CVE-2026-106120/

AI-assisted change

AI-assisted changesrc/filters/array.ts source harttle/liquidjs@7403bc2c87+7−3

@@ -1,4 +1,4 @@-import { toArray, argumentsToValue, toValue, stringify, caseInsensitiveCompare, orderedCompare, isArray, isNil, last as arrayLast, isArrayLike, toEnumerable } from '../util'+import { toArray, argumentsToValue, toValue, stringify, caseInsensitiveCompare, orderedCompare, isArray, isNil, isArrayLike, readArrayElement, toEnumerable } from '../util' import { arrayIncludes, equals, evalToken, isTruthy } from '../render' import { Value, FilterImpl } from '../template' import { Tokenizer } from '../parser'

Show 4 hidden lines

@@ -12,8 +12,12 @@ export const join = argumentsToValue(function (this: FilterImpl, v: any[], arg:   this.context.memoryLimit.use(complexity)   return array.join(sep) })

-export const last = argumentsToValue((v: any) => isArrayLike(v) ? arrayLast(v) : '')-export const first = argumentsToValue((v: any) => isArrayLike(v) ? v[0] : '')+export const last = argumentsToValue(function (this: FilterImpl, v: any) {+  return isArrayLike(v) ? readArrayElement(v, -1, this.context.ownPropertyOnly) : ''+})+export const first = argumentsToValue(function (this: FilterImpl, v: any) {+  return isArrayLike(v) ? readArrayElement(v, 0, this.context.ownPropertyOnly) : ''+}) export const reverse = argumentsToValue(function (this: FilterImpl, v: any[]) {   const array = toArray(v)

Show 1 hidden lines

   this.context.memoryLimit.use(array.length)

Security fix

Fixsrc/filters/array.ts source harttle/liquidjs@552819a84b+14−8

@@ -1,4 +1,4 @@-import { toArray, argumentsToValue, toValue, stringify, caseInsensitiveCompare, orderedCompare, isArray, isNil, last as arrayLast, isArrayLike, toEnumerable } from '../util'+import { toArray, argumentsToValue, toValue, stringify, caseInsensitiveCompare, orderedCompare, isArray, isNil, isArrayLike, readArrayElement, toEnumerable } from '../util' import { arrayIncludes, equals, evalToken, isTruthy } from '../render' import { Value, FilterImpl } from '../template' import { Tokenizer } from '../parser'

Show 2 hidden lines

@@ -10,10 +10,14 @@ export const join = argumentsToValue(function (this: FilterImpl, v: any[], arg:   const sep = isNil(arg) ? ' ' : stringify(arg)

   const complexity = array.length * (1 + sep.length)   this.context.memoryLimit.use(complexity)-  return array.join(sep)+  return Array.prototype.join.call(array, sep)+})+export const last = argumentsToValue(function (this: FilterImpl, v: any) {+  return isArrayLike(v) ? readArrayElement(v, -1, this.context.ownPropertyOnly) : ''+})+export const first = argumentsToValue(function (this: FilterImpl, v: any) {+  return isArrayLike(v) ? readArrayElement(v, 0, this.context.ownPropertyOnly) : '' })-export const last = argumentsToValue((v: any) => isArrayLike(v) ? arrayLast(v) : '')-export const first = argumentsToValue((v: any) => isArrayLike(v) ? v[0] : '')

Show 5 hidden lines

 export const reverse = argumentsToValue(function (this: FilterImpl, v: any[]) {   const array = toArray(v)   this.context.memoryLimit.use(array.length)@@ -66,14 +70,14 @@ export function * sum (this: FilterImpl, arr: Scope[], property?: string): Itera export function compact<T> (this: FilterImpl, arr: T[]) {

   const array = toArray(arr)   this.context.memoryLimit.use(array.length)-  return array.filter(x => !isNil(toValue(x)))+  return Array.prototype.filter.call(array, x => !isNil(toValue(x))) }  export function concat<T1, T2> (this: FilterImpl, v: T1[], arg: T2[] = []): (T1 | T2)[] {

Show 1 hidden lines

   const lhs = toArray(v)

   const rhs = toArray(arg)   this.context.memoryLimit.use(lhs.length + rhs.length)-  return lhs.concat(rhs)+  return Array.prototype.concat.call(lhs, rhs) }  export function push<T> (this: FilterImpl, v: T[], arg: T): T[] {

Show 3 hidden lines

@@ -110,7 +114,9 @@ export function slice<T> (this: FilterImpl, v: T[] | string, begin: number, leng   if (!isArray(v)) v = stringify(v)   begin = begin < 0 ? v.length + begin : begin

   this.context.memoryLimit.use(length)-  return v.slice(begin, begin + length)+  return isArray(v)+    ? Array.prototype.slice.call(v, begin, begin + length)+    : String.prototype.slice.call(v, begin, begin + length) }  function expectedMatcher (this: FilterImpl, expected: any): (v: any) => boolean {

Show 2 hidden lines

@@ -132,7 +138,7 @@ function * filter<T extends object> (this: FilterImpl, include: boolean, arr: T[     values.push(yield evalToken(token, this.context.spawn(item)))

   }   const matcher = expectedMatcher.call(this, expected)-  return arr.filter((_, i) => matcher(values[i]) === include)+  return Array.prototype.filter.call(arr, (_, i) => matcher(values[i]) === include) }  function * filter_exp<T extends object> (this: FilterImpl, include: boolean, arr: T[], itemName: string, exp: string): IterableIterator<unknown> {

Patch fingerprints

AI-assisted change d18a92dded8457737ab7a459217bec98ea241b530fe9f3169bde44156858ab66 · Fix 6cf632308d447721294093166a17b0f42bc819dcf7706502f9e44ba689603b91

All 28 →

Codex- and OpenCode-assisted changes in Vitest 5 replaced Vite's default file deny list with a token-only list, so a running UI, API or Browser Mode server could serve .env files, keys and .git contents.
CVE-2026-112948Oct 21, 2026vitest-dev/vitestTypeScriptChatGPT/CodexDirect introductionOther or unclear
Coraza skipped body parsing for unusual Content-Type values; a Claude-co-authored 3.8.0 fix handled parameters but not duplicate headers or leading whitespace, which hid form fields until 3.8.1.
GHSA-W253-M66G-RX24Oct 8, 2026corazawaf/corazaGoClaudeFlawed AI-written codeOther or unclear
Coraza mis-split cookies with control bytes; a Claude-co-authored 3.8.0 fix trimmed them but dropped cookies whose name was only control bytes, letting a client hide a cookie value from rules.
GHSA-G4QM-M288-5CP9Oct 8, 2026corazawaf/corazaGoClaudeFlawed AI-written codeOther or unclear
Coraza's JSON flattening let colliding keys hide a nested value from WAF rules; a Claude-assisted 3.8.0 fix closed dotted-name collisions but left case-variant collisions open until 3.8.1.
GHSA-5GJ4-9GM7-2FX2Oct 8, 2026corazawaf/corazaGoClaudeFlawed AI-written codeOther or unclear
Coraza read a decoy multipart filename when filename* used an uncommon charset; Claude-co-authored 3.8.0 fixes checked continuations only when no plain filename* was present.
GHSA-3WR7-993Q-JRFFOct 8, 2026corazawaf/corazaGoClaudeFlawed AI-written codeOther or unclear

LiquidJS's ownPropertyOnly let array filters read inherited values; a Cursor-assisted 10.27.2 fix closed only some routes, and join, reverse, slice, compact and loops still leak.

Residual filter routes still expose inherited indices

Fix in 10.27.2 is incomplete

AI-assisted change

Security fix

More Other or unclear findings

LiquidJS's ownPropertyOnly let array filters read inherited values; a Cursor-assisted 10.27.2 fix closed only some routes, and join, reverse, slice, compact and loops still leak.

Residual filter routes still expose inherited indices

Fix in 10.27.2 is incomplete

AI-assisted change

Security fix

More Other or unclear findings