| Package | Affected versions | Patched versions |
|---|---|---|
| koa-shopify-auth | = 3.1.61= 3.1.62 | |
| @shopify/koa-shopify-auth | ≥ 3.1.61, < 3.1.63 | 3.1.63 |
A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enable_cookies endpoint.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free