Shopify

14 CVEs across 15 Shopify products. Browse Shopify vulnerabilities, severities, and proof-of-concept exploits.

Shopify products with known CVEs

ProductCVEs
React-Router16
Remix-Run\/react4
Ruby-Lsp2
Tophat2
Ejson2env1
Hydrogen1
Job-Iteration1
Koa-Shopify-Auth1
Pitchfork1
React-Router\/node1
Remix-Run\/deno1
Remix-Run\/node1
Remix-Run\/server-Runtime1
Ruby Lsp1
Shopify.ruby-Lsp1
Shopify CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-481222026-08-07Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.1…
CVE-2026-55685High7.52026-07-27React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would…
CVE-2026-53669Medium6.12026-07-27React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This i…
CVE-2026-53668Medium6.92026-07-27React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. A…
CVE-2026-53667Medium6.92026-07-27React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untruste…
CVE-2026-53666Medium6.12026-07-27React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite…
CVE-2026-42342High7.52026-06-02React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain c…
CVE-2026-42211High8.12026-06-02React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized re…
CVE-2026-40181Medium6.12026-06-02React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open…
CVE-2026-34077High7.52026-06-02React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potenti…
CVE-2026-33245High8.02026-06-02React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potenti…
CVE-2026-33244Medium5.42026-06-02React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP…
CVE-2026-39862High8.82026-04-08Tophat is a mobile applications testing harness. Prior to 2.5.1, Tophat is affected by remote code execution via crafted tophat:// or http://localhost:29070 UR…
CVE-2026-34060Critical9.82026-03-31Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branc…
CVE-2026-22030Medium6.52026-01-10React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is…
CVE-2026-22029High8.02026-01-10React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open…
CVE-2026-21884High8.22026-01-10React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React…
CVE-2025-68470Medium6.52026-01-10React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Rou…
CVE-2025-61686Critical9.12026-01-10React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to v…
CVE-2025-59057High7.62026-01-10React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exis…
CVE-2025-536232025-07-14The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vul…
CVE-2025-48069Medium6.62025-05-21ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `ejson2env` tool has a vulnerability rela…
CVE-2025-30221Medium4.32025-03-27Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction…
CVE-2024-45036Medium4.32024-08-26Tophat is a mobile applications testing harness. An Improper Access Control vulnerability can expose the `TOPHAT_APP_TOKEN` token stored in `~/.tophatrc` throu…
CVE-2022-29230Medium6.32022-05-18Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting (XSS) vulnerability whe…
CVE-2020-8176Medium6.12020-07-02A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the…