Shopify

CVE-2026-63414 Oct 29, 16:39 HIGH PATCH GHSA This Week

Cross-shop context confusion in the Shopify shopify_app Ruby gem (versions 22.1.0 through 23.0.2) allows an authenticated attacker holding a valid Shopify session or ID token for one store to supply a different `shop` query parameter and have application code treat that requested shop as the current shop. The flaw is only exploitable where the host application uses token-exchange authentication and relies on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection, or shop-scoped data access, so impact is conditional on each app's own scoping logic; apps that derive shop identity from `current_shopify_session.shop` or the verified JWT `dest` claim are not affected. The vendor-released fix is version 23.0.3, and no public exploit code or confirmed active exploitation was identified at time of analysis, though the flaw is rated this_week priority by vuln.today and carries a vendor CVSS 4.0 score of 7.6.

CVE-2026-57748 Jul 02, 11:15 HIGH This Week

Local File Inclusion in the Shopify (Shopify Help Center) WordPress plugin through version 1.0.0 allows an authenticated user with at least Contributor privileges to include and read arbitrary local files on the server, potentially escalating to code execution via CWE-98-style file-inclusion abuse. The flaw was reported by Patchstack and carries a CVSS 7.5 rating driven by high confidentiality, integrity, and availability impact but with high attack complexity. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

CVE-2026-21884 Jan 10, 03:15 npm HIGH PATCH GHSA This Week

React Router is a router for React. In @remix-run/react version prior to 2.17.3. [CVSS 8.2 HIGH]

CVE-2026-39862 Apr 08, 20:16 MEDIUM PATCH This Month

Remote code execution in Tophat mobile testing harness prior to 2.5.1 allows authenticated network attackers to execute arbitrary commands on a developer's macOS workstation via unsanitized URL query parameters passed directly to bash. The vulnerability affects any developer with Tophat installed, with commands executing under the user's permissions and no confirmation dialog for previously trusted build hosts. This was fixed in version 2.5.1.

CVE-2026-22030 Jan 10, 03:15 npm MEDIUM PATCH This Month

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. [CVSS 6.5 MEDIUM]

CVE-2026-22029 Jan 10, 03:15 npm MEDIUM PATCH This Month

React Router is a router for React. In @remix-run/router version prior to 1.23.2. [CVSS 8.0 HIGH]

CVE-2025-68470 Jan 10, 03:15 npm MEDIUM PATCH This Month

React-Router versions up to 6.30.1 is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).

CVE-2025-61686 Jan 10, 03:15 npm CRITICAL PATCH GHSA Act Now

React Router (@react-router/node 7.0.0-7.9.3) has a path traversal in file-based session storage when using unsigned cookies. Attackers can manipulate session file paths to read or write arbitrary files on the server.

CVE-2025-59057 Jan 10, 03:15 npm HIGH PATCH GHSA This Week

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. [CVSS 7.6 HIGH]

CVE-2022-29230 May 18, 21:15 npm MEDIUM PATCH This Month

Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2020-8176 Jul 02, 19:15 npm MEDIUM POC PATCH This Month

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the `/shopify/auth/enable_cookies` endpoint. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.