Shopify · disclosed reports
Command and Code Injection
5 disclosed reports · $1,500 paid · 3 valid · 2 not checked yet
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Shopify on HackerOne- reports
- 5
- valid
- 3
- paid a bounty
- 1
Every one of the 5 is a mark on the map. Named now: 1 to 5, most upvoted first.
- H1514 Remote Code Execution on kitcrm using bulk customer update of Priority Products
- H1514 Server Side Template Injection in Return Magic email templates?
- Attention! Remote Code Execution at http://wpt.ec2.shopify.com/
- 'Limited' RCE in certain places where Liquid is accepted
- CSV Excel Macro Injection Vulnerability in export list of current users - app.shopify.com
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP