Description
A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the `/shopify/auth/enable_cookies` endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | koa-shopify-auth | Impacted: v3.1.61-v3.1.62, Fixed: v3.1.63 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @shopify/koa-shopify-auth | >= 3.1.61, < 3.1.63 | 3.1.63 | GHSA-jqh7-w5pr-cr56 |