CVE-2026-63414

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active Shopify session. currentshopifydomain can resolve to the...

CVE-2026-63414 Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active Shopify session. currentshopifydomain can resolve to the...

CVE-2026-63414

The Shopify App Rails engine (versions 22.1.0 through 23.0.3 ) contains a vulnerability where token-exchange authenticated controllers can expose a request-derived shop context. Specifically, the current_shopify_domain helper could resolve to a sanitized shop query parameter instead of the identi...

CVE-2026-63414 Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active Shopify session. currentshopifydomain can resolve to the...

EUVD-2026-114553

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active Shopify session. currentshopifydomain can resolve to the...

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

In token-exchange authenticated controllers, shopifyapp exposes shop context through helpers such as currentshopifydomain. Prior to the fix, currentshopifydomain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active...

GHSA-6J52-38F8-QHXR Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

In token-exchange authenticated controllers, shopifyapp exposes shop context through helpers such as currentshopifydomain. Prior to the fix, currentshopifydomain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active...

PT-2026-133263

Name of the Vulnerable Software and Affected Versions Shopify App versions 22.1.0 through 23.0.2 Description In token-exchange authenticated controllers, the software exposes shop context through helpers such as current shopify domain. The current shopify domain helper can resolve to the sanitize...

PT-2026-133238

In token-exchange authenticated controllers, shopify app exposes shop context through helpers such as current shopify domain. Prior to the fix, current shopify domain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or...

SEO King - Shopify App — Installer Detection

Shopify App is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Shopify App is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the currentshopifydomain helper. An attacker can gain unauthorized access to resources belonging to a different shop by sending a request authenticated for one shop while including a different shop in the quer...

Malicious Package

Overview shopify-app-bridge-internal is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malware in shopify-app-bridge-internal

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-5452 Malicious code in shopify-app-bridge-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b21c63417fe3a82fd514d0af7c913fb3c1cd62915839dc8910483fb6484bbbd9 The package's preinstall lifecycle script in package.json runs unconditionally on npm install and issues an HTTPS GET to...

Malicious code in shopify-app-bridge-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b21c63417fe3a82fd514d0af7c913fb3c1cd62915839dc8910483fb6484bbbd9 The package's preinstall lifecycle script in package.json runs unconditionally on npm install and issues an HTTPS GET to...

Malicious code in shopify-app-extension-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf25a3a07b9adf8865f783819176d646b7c5485aeb1539422555bf596abfeaa7 The package shopify-app-extension-template was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3051 Malicious code in shopify-app-extension-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf25a3a07b9adf8865f783819176d646b7c5485aeb1539422555bf596abfeaa7 The package shopify-app-extension-template was found to contain malicious code. Source: ossf-package-analysis...

Malicious Package

Overview shopify-app-react-router is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2025-192977 Malicious code in shopify-app-react-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d58b68abe183faeee5b24e4b524d982d1c78881c8d0c48dd847411bf8fc087e6 The package shopify-app-react-router was found to contain malicious code. Source: ghsa-malware...

Malware in shopify-app-react-router

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...