PT-2022-19481 · Hydrogen · Hydrogen

Published 2022-05-18 · Updated 2022-06-01 · CVE-2022-29230

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Hydrogen versions 0.10.0 through 0.18.0

Description There is a potential Cross-Site Scripting (XSS) vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This vulnerability is exploitable in applications whose hydrating data is user controlled. The Content Security Policy is not an effective mitigation for this vulnerability.

Recommendations For Hydrogen versions 0.10.0 through 0.18.0, upgrade the project to version 0.19.0 as soon as possible, as there is no current workaround for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-29230

GHSA-6J22-WV8G-894F

Affected Products

Hydrogen

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29230.json · Exploit
• https://github.com/Shopify/hydrogen/releases/tag/%40shopify/hydrogen%400.19.0 · Patch
• https://github.com/Shopify/hydrogen/pull/1272 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29230 · Security Note
• https://osv.dev/vulnerability/GHSA-6j22-wv8g-894f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29230 · Vendor Advisory
• https://github.com/Shopify/hydrogen/security/advisories/GHSA-6j22-wv8g-894f · Note
• https://github.com/Shopify/hydrogen · Note
• https://t.me/cibsecurity/42958 · Telegram Post