Description
A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the `/shopify/auth/enable_cookies` endpoint.
Remediation
References
https://github.com/Shopify/quilt/pull/1455
https://hackerone.com/reports/881409
Related Vulnerabilities
CVE-2018-1335 Vulnerability in maven package org.apache.tika:tika-server
CVE-2012-5784 Vulnerability in maven package axis:axis
CVE-2022-21144 Vulnerability in npm package libxmljs
CVE-2017-16138 Vulnerability in npm package mime
CVE-2021-45046 Vulnerability in maven package org.apache.logging.log4j:log4j-core