Skip to content
OpenAdvisories

Vendor

Shopify

9 known vulnerabilities.

Products

tophat 2 ruby-lsp 2 pitchfork 1 Shopify.ruby-lsp 1 shopify_app 1 job-iteration 1 hydrogen 1 ejson2env 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.6
    CVE-2026-63414

    Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

    Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify sessio…

    Shopify shopify_app shopify_app RubyGems
  • High 7.1
    CVE-2026-34060

    Ruby LSP has arbitrary code execution through branch setting

    Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing…

    Shopify ruby-lsp Shopify.ruby-lsp ruby-lsp Debian RubyGems
  • High 8.1
    CVE-2025-53623

    Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class

    The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vulnerability in the `CsvEnumerator` class. This vulnerability can be exploited by an attacker to execu…

    Shopify job-iteration job-iteration RubyGems