CVE-2022-29230

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting (XSS) vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects all versions of Hydrogen starting from version 0.10.0 to 0.18.0. This vulnerability is exploitable in applications whose hydrating data is user controlled. All Hydrogen users should upgrade their project to version 0.19.0. There is no current workaround, and users should update as soon as possible. Additionally, the Content Security Policy is not an effective mitigation for this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Shopify	hydrogen	>= 0.10.0, <= 0.18.0

References

https://github.com/Shopify/hydrogen/pull/1272Issue Tracking, Patch, Third Party Advisory
https://github.com/Shopify/hydrogen/releases/tag/%40shopify/hydrogen%400.19.0Patch, Third Party Advisory
https://github.com/Shopify/hydrogen/security/advisories/GHSA-6j22-wv8g-894fThird Party Advisory
https://github.com/Shopify/hydrogen/pull/1272Issue Tracking, Patch, Third Party Advisory
https://github.com/Shopify/hydrogen/releases/tag/%40shopify/hydrogen%400.19.0Patch, Third Party Advisory
https://github.com/Shopify/hydrogen/security/advisories/GHSA-6j22-wv8g-894fThird Party Advisory

Timeline

Published: May 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-292326.5BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker c CVE-2022-292334.3BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can CVE-2022-292344.3BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4.1, an attacker could s CVE-2022-292355.3BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who CVE-2022-292364.3BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can CVE-2022-292375.4Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users c CVE-2022-292384.3Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the noteb CVE-2022-29245.4Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3.CVE-2022-292408.1Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame recei CVE-2022-292418.8Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter Notebook. P CVE-2022-292427.5GOST engine is a reference implementation of the Russian GOST crypto algorithms for OpenSSL. TLS clients using GOST engine when ciphersuite CVE-2022-292434.3Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missin