### Impact The built-in `FileSystemLoader` and `CachingFileSystemLoader` do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the `{% include %}` and `{% render %}` tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. ### Patches The issue is fixed in version 2.2.0 with the inclusion of a `template_path.is_absolute()` condition in `liquid/builtin/loaders/file_system_loader.py`. ```python if os.path.pardir in template_path.parts or template_path.is_absolute(): raise TemplateNotFoundError(template_name) ``` ### Workarounds Create a custom template loader by inheriting from `FileSystemLoader` and overriding `resolve_path()`. Use an instance of the custom loader as the `loader` argument when instantiating your Liquid environment. ```python import os from pathlib import Path from liquid import Environment from liquid import FileSystemLoader from liquid.exceptions import TemplateNotFoundError class MyFileSystemLoader(FileSystemLoader): def resolve_path(self, template_name: str) -> Path: template_path = Path(template_name) if self.ext and not template_path.suffix: template_path = template_path.with_suffix(self.ext) if os.path.pardir in template_path.parts or template_path.is_absolute(): raise TemplateNotFoundError(template_name) for path in self.search_path: source_path = path.joinpath(template_path) if not source_path.exists(): continue return source_path raise TemplateNotFoundError(template_name) env = Environment(loader=MyFileSystemLoader("path/to/templates/")) ```
### Impact The built-in `FileSystemLoader` and `CachingFileSystemLoader` do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the `{% include %}` and `{% render %}` tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. ### Patches The issue is fixed in version 2.2.0 with the inclusion of a `template_path.is_absolute()` condition in `liquid/builtin/loaders/file_system_loader.py`. ```python if os.path.pardir in template_path.parts or template_path.is_absolute(): raise TemplateNotFoundError(template_name) ``` ### Workarounds Create a custom template loader by inheriting from `FileSystemLoader` and overriding `resolve_path()`. Use an instance of the custom loader as the `loader` argument when instantiating your Liquid environment. ```python import os from pathlib import Path from liquid import Environment from liquid import FileSystemLoader from liquid.exceptions import TemplateNotFoundError class MyFileSystemLoader(FileSystemLoader): def resolve_path(self, template_name: str) -> Path: template_path = Path(template_name) if self.ext and not template_path.suffix: template_path = template_path.with_suffix(self.ext) if os.path.pardir in template_path.parts or template_path.is_absolute(): raise TemplateNotFoundError(template_name) for path in self.search_path: source_path = path.joinpath(template_path) if not source_path.exists(): continue return source_path raise TemplateNotFoundError(template_name) env = Environment(loader=MyFileSystemLoader("path/to/templates/")) ```
Update python-liquid to 2.2.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanpython-liquid: Absolute paths escape filesystem loader search path affects python-liquid (pip). Severity is high. ### Impact The built-in `FileSystemLoader` and `CachingFileSystemLoader` do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the `{% include %}` and `{% render %}` tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. ### Patches The issue is fixed in version 2.2.0 with the inclusion of a `template_path.is_absolute()` condition in `liquid/builtin/loaders/file_system_loader.py`. ```python if os.path.pardir in template_path.parts or template_path.is_absolute(): raise TemplateNotFoundError(template_name) ``` ### Workarounds Create a custom template loader by inheriting from `FileSystemLoader` and overriding `resolve_path()`. Use an instance of the custom loader as the `loader` argument when instantiating your Liquid environment. ```python import os from pathlib import Path from liquid import Environment from liquid import FileSystemLoader from liquid.exceptions import TemplateNotFoundError class MyFileSystemLoader(FileSystemLoader): def resolve_path(self, template_name: str) -> Path: template_path = Path(template_name) if self.ext and not template_path.suffix: template_path = template_path.with_suffix(self.ext) if os.path.pardir in template_path.parts or template_path.is_absolute(): raise TemplateNotFoundError(template_name) for path in self.search_path: source_path = path.joinpath(template_path) if not source_path.exists(): continue return source_path raise TemplateNotFoundError(template_name) env = Environment(loader=MyFileSystemLoader("path/to/templates/")) ```
AI coding agents often install or upgrade packages automatically in pip. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| python-liquidpip | <2.2.0 | 2.2.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate python-liquid to 2.2.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanpython-liquid: Absolute paths escape filesystem loader search path affects python-liquid (pip). Severity is high. ### Impact The built-in `FileSystemLoader` and `CachingFileSystemLoader` do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the `{% include %}` and `{% render %}` tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. ### Patches The issue is fixed in version 2.2.0 with the inclusion of a `template_path.is_absolute()` condition in `liquid/builtin/loaders/file_system_loader.py`. ```python if os.path.pardir in template_path.parts or template_path.is_absolute(): raise TemplateNotFoundError(template_name) ``` ### Workarounds Create a custom template loader by inheriting from `FileSystemLoader` and overriding `resolve_path()`. Use an instance of the custom loader as the `loader` argument when instantiating your Liquid environment. ```python import os from pathlib import Path from liquid import Environment from liquid import FileSystemLoader from liquid.exceptions import TemplateNotFoundError class MyFileSystemLoader(FileSystemLoader): def resolve_path(self, template_name: str) -> Path: template_path = Path(template_name) if self.ext and not template_path.suffix: template_path = template_path.with_suffix(self.ext) if os.path.pardir in template_path.parts or template_path.is_absolute(): raise TemplateNotFoundError(template_name) for path in self.search_path: source_path = path.joinpath(template_path) if not source_path.exists(): continue return source_path raise TemplateNotFoundError(template_name) env = Environment(loader=MyFileSystemLoader("path/to/templates/")) ```
AI coding agents often install or upgrade packages automatically in pip. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| python-liquidpip | <2.2.0 | 2.2.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard