Shopify vulnerabilities
We track 7 vulnerabilities in Shopify products across 9 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Shopify vulnerabilities
- 7.6 High severity
shopify_app: Incorrect Authorization
Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session
- 8.8 High severity
tophat: Improper Neutralization of Special Elements used in an OS Command
Tophat is a mobile applications testing harness. Prior to 2.5.1, Tophat is affected by remote code execution via crafted tophat:// or http://localhost:29070 URLs. The arguments query parameter flows unsanitized from URL parsing through to /bin/bash -c executio
- 7.1 High severity
ruby-lsp: Improper Control of Generation of Code
Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing
- 8.2 High severity
react-router: Improper Neutralization of Input During Web Page Generation
React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Serv
- 9.1 Critical severity
react-router: Improper Limitation of a Pathname to a Restricted Directory
React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/nod
- 7.6 High severity
react-router: Improper Neutralization of Input During Web Page Generation
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags whic
- 8.1 High severity
job-iteration: Improper Neutralization of Special Elements used in an OS Command
The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vulnerability in the `CsvEnumerator` class. This vulnerability can be exploited by an attacker to execut