Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
Shopify/cli
main @ 4843183
33
Fixes
0
CVEs
CRITICAL
Peak severity
52.0%
Coverage
Highlights
Information Disclosure: 9 prior fixes. Scrutinize any change in this area.
packages/theme/src/cli/utilities/theme-environment/proxy.ts: most-fixed (5 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: The tree-kill implementation on Windows utilized child_process.exec without adequate input validation, allowing arbitrary shell command execution via manipulated PIDs. This was resolved by switching to spawn and enforcing strict numeric validation on the PID argument.
Auth Bypass: Local sessions could be incorrectly reused or refreshed without validating whether the identity token was still valid or had been revoked. The security context was improved by prioritizing identity validation and token revocation checks before evaluating expiration metadata or initiating token exchange.
DNS Rebinding: Local development servers (such as the app extension development server and the theme development server) were vulnerable to DNS rebinding because they accepted connection requests without validating the Host header. This allowed malicious external websites to make unauthorized requests to the local development environment.