Skip to content
OpenAdvisories

Vendor

Shopify

9 known vulnerabilities.

Products

tophat 2 ruby-lsp 2 pitchfork 1 Shopify.ruby-lsp 1 shopify_app 1 job-iteration 1 hydrogen 1 ejson2env 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-48122

    Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension

    Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler …

    Shopify ruby-lsp ruby-ruby-lsp Ubuntu
  • Medium 6.3
    CVE-2026-39862

    Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link

    Tophat is a mobile applications testing harness. Prior to 2.5.1, Tophat is affected by remote code execution via crafted tophat:// or http://localhost:29070 URLs. The arguments query parameter flows unsanitized from URL parsing through to /bin/bash -c executi…

    Shopify tophat
  • Medium 6.6
    CVE-2025-48069

    ejson2env has insufficient input sanitization

    ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `ejson2env` tool has a vulnerability related to how it writes to `stdout`. Specifically, the tool is intended to write an export statement fo…

    Shopify ejson2env github.com/Shopify/ejson2env/v2 github.com/Shopify/ejson2env Go RubyGems
  • Medium 4.3
    CVE-2025-30221

    Pitchfork HTTP Request/Response Splitting vulnerability

    Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.

    Shopify pitchfork pitchfork RubyGems
  • Medium 4.3
    CVE-2024-45036

    Improper Access Control Vulnerability When Accessing a Maliciously Crafted Tophat Link

    Tophat is a mobile applications testing harness. An Improper Access Control vulnerability can expose the `TOPHAT_APP_TOKEN` token stored in `~/.tophatrc` through use of a malicious Tophat URL controlled by the attacker. The vulnerability allows Tophat to send…

    Shopify tophat
  • Medium 6.3
    CVE-2022-29230

    Potential cross-site scripting (XSS) vulnerability in Hydrogen

    Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting (XSS) vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects …

    Shopify hydrogen @shopify/hydrogen npm