The Shopify App had a vulnerability in token-exchange authenticated controllers where `current_shopify_domain` could resolve to the sanitized `shop` query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session. This could cause application code to treat the requested shop as the current shop, potentially allowing cross-shop authorization bypass. Defende [truncated]
The Ruby LSP VS Code extension prior to version 0.10.4 had a vulnerability where several workspace-level settings could be overridden by a malicious repository, potentially leading to code execution with the privileges of the developer. This issue arises from the extension's ability to execute code with developer privileges when a malicious repository containing a `.vscode/settings.json` file is opened an [truncated]
