GHSA-jqh7-w5pr-cr56
Cross-site scripting in @shopify/koa-shopify-auth
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @shopify/koa-shopify-auth | >= 3.1.61, < 3.1.63 | 3.1.63 |
Details
As written in the advisory (Markdown source, shown as plain text).
A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the `/shopify/auth/enable_cookies` endpoint.
References
External links from the advisory. They lead to third-party sites.