Vulnerability in pouchdb project

[ankitdn]

While working on pouchdb project, I identified a security vulnerability related to the LiquidJS templating engine dependency. The issue corresponds to CVE-2026-30952, which allows path traversal and unauthorized file access through template rendering mechanisms.

CVE Report
CVE Link

[janl]

Hi and thanks for the report. LiquidJS is a sub-dep of our new website builder 11ty. It does not apply to running or using PouchDB itself or visiting the PouchDB website.

We should upgrade 11ty or whatever is necessary to not be affected, but there is no exploitation path here.