Login Request a demo
SH
Vendor
Shopify
13 products with CVEs on record
32
CVEs
0
On KEV
0
New 30D
Products
RE
React-router
Shopify
8.2
16 CVEs0 on KEV0 new
RE
Remix-run/react
Shopify
8.2
4 CVEs0 on KEV0 new
RU
ruby-lsp
Shopify
9.8
2 CVEs0 on KEV0 new
EJ
ejson2env
Shopify
6.6
1 CVEs0 on KEV0 new
HY
Hydrogen
Shopify
5.4
1 CVEs0 on KEV0 new
JO
job-iteration
Shopify
8.1
1 CVEs0 on KEV0 new
KO
Koa-shopify-auth
Shopify
6.1
1 CVEs0 on KEV0 new
RE
React-router/node
Shopify
9.1
1 CVEs0 on KEV0 new
RE
Remix-run/deno
Shopify
9.1
1 CVEs0 on KEV0 new
RE
Remix-run/node
Shopify
9.1
1 CVEs0 on KEV0 new
RE
Remix-run/server-runtime
Shopify
7.5
1 CVEs0 on KEV0 new
SH
Shopify.ruby-lsp
Shopify
9.8
1 CVEs0 on KEV0 new
TO
tophat
Shopify
8.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-48122
RU
ruby-lsp
Shopify
5.4
0%
Aug 7Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension
CVE-2026-53669
RE
React-router
Shopify
6.1
0%
Jul 27React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
CVE-2026-55685
RE
React-router
Shopify
7.5
1%
Jul 27React Router: Unauthenticated Denial of Service via Inefficient Route Matching
CVE-2026-53668
RE
React-router
Shopify
6.9
0%
Jul 27React Router: Open redirect can lead to XSS
CVE-2026-53667
RE
React-router
Shopify
6.1
0%
Jul 27React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)
CVE-2026-53666
RE
React-router
Shopify
6.1
0%
Jul 27React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
CVE-2026-42342
RE
React-router
Shopify
7.5
0%
Jun 2React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
CVE-2026-42211
RE
React-router
Shopify
8.1
0%
Jun 2React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
CVE-2026-40181
RE
React-router
Shopify
6.1
0%
Jun 2React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
CVE-2026-34077
RE
React-router
Shopify
7.5
0%
Jun 2React Router vulnerable to Denial of Service via reflected user input in single-fetch
CVE-2026-33245
RE
React-router
Shopify
4.7
0%
Jun 2React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
CVE-2026-33244
RE
React-router
Shopify
5.4
0%
Jun 2React Router has stored XSS via unescaped Location header in prerendered redirect HTML
CVE-2026-39862
TO
tophat
Shopify
8.8
1%
Apr 8Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link
CVE-2026-34060
SH
Shopify.ruby-lsp
Shopify
9.8
0%
Mar 31Ruby LSP has arbitrary code execution through branch setting
CVE-2026-22030
RE
Remix-run/react
Shopify
6.5
0%
Jan 10React Router has CSRF issue in Action/Server Action Request Processing
CVE-2026-22029
RE
React-router
Shopify
6.1
1%
Jan 10React Router vulnerable to XSS via Open Redirects
CVE-2026-21884
RE
Remix-run/react
Shopify
8.2
1%
Jan 10React Router SSR XSS in ScrollRestoration
CVE-2025-61686
RE
Remix-run/deno
Shopify
9.1
17%
Jan 10React Router has Path Traversal in File Session Storage
CVE-2025-59057
RE
Remix-run/react
Shopify
7.6
1%
Jan 10React Router has XSS Vulnerability
CVE-2025-68470
RE
React-router
Shopify
6.5
0%
Jan 10React Router has unexpected external redirect via untrusted paths
CVE-2025-53623
JO
job-iteration
Shopify
8.1
1%
Jul 14Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class
CVE-2025-48069
EJ
ejson2env
Shopify
6.6
1%
May 21ejson2env has insufficient input sanitization
CVE-2022-29230
HY
Hydrogen
Shopify
5.4
1%
May 18Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts
CVE-2020-8176
KO
Koa-shopify-auth
Shopify
6.1
1%
Jul 2A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the…