Vulnerabilities in Shopify
9 resultsCVE-2025-48069MEDIUMejson2env has insufficient input sanitizationEPSS 1.4%CVE-2025-53623HIGHJob Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator classEPSS 0.8%CVE-2022-29230MEDIUMPotential cross-site scripting (XSS) vulnerability in HydrogenEPSS 0.8%CVE-2026-63414HIGHShopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected appsEPSS 0.7%CVE-2026-39862MEDIUMTophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat LinkEPSS 0.6%CVE-2026-34060HIGHRuby LSP has arbitrary code execution through branch settingEPSS 0.5%CVE-2025-30221MEDIUMPitchfork HTTP Request/Response Splitting vulnerabilityEPSS 0.3%CVE-2024-45036MEDIUMImproper Access Control Vulnerability When Accessing a Maliciously Crafted Tophat LinkEPSS 0.3%CVE-2026-48122MEDIUMWorkspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extensionEPSS 0.2%