Vendor

    Shopify

    27 known vulnerabilities in products by Shopify, 0 of them actively exploited (CISA KEV).

    Key figures

    27

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Shopify
    CriticalCVE-2025-61686

    React Router has Path Traversal in File Session Storage

    also in 1 other product

    		9.1
    HighCVE-2026-55685

    React Router: Unauthenticated Denial of Service via Inefficient Route Matching

    also in 1 other product

    		7.5
    HighCVE-2026-63414

    Shopify App: Incorrect Authorization

    		—
    MediumCVE-2025-48069

    ejson2env has insufficient input sanitization

    also in 1 other product

    		6.6
    HighCVE-2026-22029

    React Router vulnerable to XSS via Open Redirects

    also in 2 other products

    		8.0
    CriticalCVE-2026-34060

    Ruby LSP has arbitrary code execution through branch setting

    		9.8
    HighCVE-2026-39862

    Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link

    		8.8
    HighCVE-2025-53623

    Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class

    		—
    HighCVE-2026-21884

    React Router SSR XSS in ScrollRestoration

    also in 1 other product

    		8.2
    HighCVE-2026-42211

    Remix-run React-router: Deserialization of Untrusted Data

    also in 2 other products

    		8.1
    HighCVE-2025-59057

    React Router has XSS Vulnerability

    also in 1 other product

    		7.6
    MediumCVE-2026-53666

    React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

    also in 1 other product

    		6.1
    MediumCVE-2026-53668

    React Router: Open redirect can lead to XSS

    also in 1 other product

    		6.9
    MediumCVE-2020-8176

    Koa-shopify-auth: Cross-site Scripting

    		6.1
    MediumCVE-2025-68470

    React Router has unexpected external redirect via untrusted paths

    also in 2 other products

    		6.5
    HighCVE-2026-42342

    React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

    also in 2 other products

    		7.5
    HighCVE-2026-34077

    React Router vulnerable to Denial of Service via reflected user input in single-fetch

    also in 2 other products

    		7.5
    MediumCVE-2026-53667

    Remix-run React-router: Cross-site Scripting

    also in 1 other product

    		6.1
    MediumCVE-2022-29230

    Potential cross-site scripting (XSS) vulnerability in Hydrogen

    		6.3
    HighCVE-2026-33245

    React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

    also in 1 other product

    		8.0
    MediumCVE-2026-53669

    React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

    also in 1 other product

    		6.1
    MediumCVE-2026-40181

    Remix-run React-router: Open Redirect

    also in 2 other products

    		6.1
    MediumCVE-2026-48122

    Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension

    		—
    MediumCVE-2026-22030

    React Router has CSRF issue in Action/Server Action Request Processing

    also in 1 other product

    		6.5
    MediumCVE-2026-33244

    React Router has stored XSS via unescaped Location header in prerendered redirect HTML

    also in 1 other product

    		5.4

    All vulnerabilities in search

    Products

    Products by Shopify
    Shopify React-router160
    Remix-run\/react40
    Ruby-lsp30