Description
A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the `/shopify/auth/enable_cookies` endpoint.
Remediation
References
https://github.com/Shopify/quilt/pull/1455
https://hackerone.com/reports/881409
Related Vulnerabilities
CVE-2023-37963 Vulnerability in maven package io.jenkins.plugins:benchmark-evaluator
CVE-2021-37713 Vulnerability in npm package tar
CVE-2022-29546 Vulnerability in maven package net.sourceforge.nekohtml:nekohtml
CVE-2023-33962 Vulnerability in maven package io.jstach:jstachio
CVE-2023-24620 Vulnerability in maven package com.esotericsoftware.yamlbeans:yamlbeans