Shopify vulnerabilities
9 published CVEs name Shopify among the affected products.
- 9Published CVEs9 of them scored
- 4Last 12 monthspublished in the last year
- 0Critical3 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-63414
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
Shopify · shopify_app
High7.6 - CVE-2026-48122
Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension
Shopify · ruby-lsp
Medium5.4 - CVE-2026-39862
Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link
Shopify · tophat
Medium6.3 - CVE-2026-34060
Ruby LSP has arbitrary code execution through branch setting
Shopify · ruby-lsp
High7.1 - CVE-2025-53623
Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class
Shopify · job-iteration
High8.1 - CVE-2025-48069
ejson2env has insufficient input sanitization
Shopify · ejson2env
Medium6.6 - CVE-2025-30221
Pitchfork HTTP Request/Response Splitting vulnerability
Shopify · pitchfork
Medium4.3 - CVE-2024-45036
Improper Access Control Vulnerability When Accessing a Maliciously Crafted Tophat Link
Shopify · tophat
Medium4.3 - CVE-2022-29230
Potential cross-site scripting (XSS) vulnerability in Hydrogen
Shopify · hydrogen
Medium6.3