# CVE-2022-29230: Shopify Hydrogen cross-site scripting in hydrating data

Source: https://junglewise.ai/threats/cve-2022-29230-shopify-hydrogen-cross-site-scripting-in-hydrating-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-29230 · Severity: low · CVSS 3.1 · Published 2022-05-19

Hydrogen is a framework for building storefronts powered by Shopify. A cross-site scripting vulnerability allows attackers to inject and execute arbitrary scripts on pages built with Hydrogen when user-controlled data is used during hydration, potentially stealing customer credentials, session tokens, or personal information.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Shopify](https://junglewise.ai/threats/vendors/shopify).

## Quick answers

**Is CVE-2022-29230 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-29230 being exploited in the wild.

**How severe is CVE-2022-29230?** Low severity, with a CVSS score of 3.1, published 19 May 2022.

**Which products and versions are affected?** @shopify/hydrogen (npm) SEMVER:introduced=0.10.0,fixed=0.19.0; Shopify Hydrogen 0.10.0 to 0.18.0.

**Is there a fix for CVE-2022-29230?** Yes. @shopify/hydrogen (npm): upgrade to 0.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-29230 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-29230?** Check whether you run @shopify/hydrogen (npm) or Shopify Hydrogen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @shopify/hydrogen (npm): upgrade to 0.19.0 or later

  ```sh
  npm install @shopify/hydrogen@0.19.0
  ```


## Technical details

This is a cross-site scripting (XSS) vulnerability (CWE-79) in Shopify's Hydrogen framework that affects versions 0.10.0 through 0.18.0. The vulnerability exists in the hydrating data processing logic; when hydration data is sourced from user input, an attacker can inject malicious scripts that execute in the browser context of other users visiting pages built with affected Hydrogen versions. The attack requires no authentication and is network-accessible. An attacker can execute arbitrary JavaScript, potentially stealing session tokens, harvesting sensitive data, or performing actions on behalf of legitimate users. The vulnerability is patched in version 0.19.0; no workaround is available, and Content Security Policy does not effectively mitigate the issue.

## Affected products

- Shopify Hydrogen 0.10.0 to 0.18.0

## Identifiers

- CVE-2022-29230
- GHSA-6j22-wv8g-894f

## Timeline

- 2022-05-19: disclosed
- 2022-05-19: patched: Fixed in version 0.19.0

## References

- [https://github.com/Shopify/hydrogen/security/advisories/GHSA-6j22-wv8g-894f](https://github.com/Shopify/hydrogen/security/advisories/GHSA-6j22-wv8g-894f)