Vulnerability · Published Apr 8, 2026 · Assigned by GitHub_M

CVE-2026-39862Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link

Medium 6.3

In plain English

A medium-severity OS command injection in tophat from Shopify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.6%top 52.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tophat is a mobile applications testing harness. Prior to 2.5.1, Tophat is affected by remote code execution via crafted tophat:// or http://localhost:29070 URLs. The arguments query parameter flows unsanitized from URL parsing through to /bin/bash -c execution, allowing an attacker to execute arbitrary commands on a developer's macOS workstation. Any developer with Tophat installed is vulnerable. For previously trusted build hosts, no confirmation dialog appears. Attacker commands run with the user's permissions. This vulnerability is fixed in 2.5.1.

Affected products (as reported)

Vendor	Product	Versions
Shopify	tophat	< 2.5.1

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

https://github.com/Shopify/tophat/security/advisories/GHSA-8x8g-6rv5-mgg2 x_refsource_CONFIRM
https://github.com/Shopify/tophat/pull/139 x_refsource_MISC