CVE-2026-69222

CVE-2026-69222 exposes a fundamental mismatch between LiquidJS's complexity accounting and actual resource consumption. The join and array_to_sentence_string filters charge based on input array length, but they materialize the entire output string—which can be orders of magnitude larger than the complexity budget suggests. A template that builds a modest array with concat, then joins it, can trigger memory allocation far exceeding what the complexity limit was supposed to enforce. This isn't a simple calculation bug; it's an architectural flaw where the cost model treats reference manipulation (free) and string materialization (charged per-element, not per-output-size) as fundamentally misaligned operations. Two independent filters made the same accounting mistake, suggesting the underlying model was never designed to track reference graph depth or actual string allocation. Version 10.27.2 adds a guard that triggers on V8 string limits, which closes this specific crash vector—but it's a surgical patch on a broken premise. The deeper question is whether the complexity model can ever meaningfully govern string materialization, since computing the cost before materialization is either impossible or defeats the purpose. From a defensive posture: upgrade to 10.27.2 immediately, but treat this as a known gap rather than a closed class. Audit any filter chains that combine array construction with string-emitting filters, even when complexity limits appear configured. The vulnerability is reliably reproducible—an attacker doesn't need precise memory engineering, just enough concatenation to push past V8's string length threshold. This pattern of a cost proxy diverging from actual consumption has recurred across template engines and sandboxing systems; treating the patch as a single fix rather than evidence of a broader architectural problem leaves you exposed to the next variant.

Reviewed through automated stages and approved by a human before publication.