Medium severity6.1NVD Advisory· Published Jul 2, 2020· Updated Jun 17, 2026
CVE-2020-8176
CVE-2020-8176
Description
A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enable_cookies endpoint.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@shopify/koa-shopify-authnpm | >= 3.1.61, < 3.1.63 | 3.1.63 |
Affected products
4cpe:2.3:a:shopify:koa-shopify-auth:3.1.61:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:shopify:koa-shopify-auth:3.1.61:*:*:*:*:*:*:*
- cpe:2.3:a:shopify:koa-shopify-auth:3.1.62:*:*:*:*:*:*:*
- koa-shopify-auth/koa-shopify-authdescription
Patches
Vulnerability mechanics
References
4- github.com/Shopify/quilt/pull/1455nvdExploitPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-jqh7-w5pr-cr56ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-8176ghsaADVISORY
- hackerone.com/reports/881409nvdPermissions RequiredWEB
News mentions
0No linked articles in our index yet.