PT-2026-31441 · Tophat · Tophat

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-39862

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tophat versions prior to 2.5.1

Description Tophat, a mobile applications testing harness, is susceptible to remote code execution through specially crafted tophat:// or http://localhost:29070 URLs. The arguments query parameter is processed without proper sanitization, leading to execution of arbitrary commands via /bin/bash -c on a developer's macOS workstation. Developers with Tophat installed are affected. No confirmation dialog is displayed for previously trusted build hosts, and attacker commands execute with the user's permissions.

Recommendations Update to version 2.5.1 or later.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-39862

Affected Products

Tophat

References · 4

• https://github.com/Shopify/tophat/security/advisories/GHSA-8x8g-6rv5-mgg2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39862 · Security Note
• https://github.com/Shopify/tophat/pull/139 · Note
• https://twitter.com/VulmonFeeds/status/2041988306783596814 · Twitter Post