CVE-2022-29230: Potential Cross-site Scripting vulnerability in Hydrogen
Summary
CVE-2022-29230: Potential Cross-site Scripting vulnerability in Hydrogen. Affects @shopify/hydrogen versions >= 0.10.0, < 0.19.0. Fixed in 0.19.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hydrogen is an open-source library used for building static websites with React components. It provides a framework for server-side rendering and client-side hydration of React components. Hydrogen is widely used in web development projects to create dynamic and interactive user interfaces. However, versions 0.10.0 to 0.18.0 of Hydrogen are vulnerable to a potential Cross-Site Scripting (XSS) attack.
Vulnerability Detail
The vulnerability in Hydrogen allows an arbitrary user to execute scripts on pages that are built with Hydrogen. This can lead to unauthorized access, data theft, and other malicious activities. The vulnerability is exploitable in applications where the hydrating data is controlled by the user. It affects all versions of Hydrogen from 0.10.0 to 0.18.0. The Content Security Policy is not an effective mitigation for this vulnerability.
How To Fix
Latest published version: 2026.10.2 as of 23 Oct 2026
npm install @shopify/hydrogen@2026.10.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.19.0
This is the first release that contains the fix.
npm install @shopify/hydrogen@0.19.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no current workaround for this vulnerability. Users are strongly advised to update their Hydrogen projects to the latest version as soon as possible.
Conclusion
The potential Cross-Site Scripting vulnerability in Hydrogen (CVE-2022-29230) can have serious security implications for applications using affected versions of the library. It is crucial for Hydrogen users to upgrade their projects to version 0.19.0 or later to mitigate the risk of XSS attacks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @shopify/hydrogen →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts on pages built with Hydrogen, potentially leading to unauthorized access, data theft, and other malicious activities.
The vulnerability affects all versions of Hydrogen from 0.10.0 to 0.18.0.
No, there is no current workaround. Users should update their Hydrogen projects to the latest version to fix the vulnerability.
No, the Content Security Policy is not an effective mitigation for this vulnerability.
You can find more information in the GitHub advisory for Hydrogen: https://github.com/Shopify/hydrogen/security/advisories/GHSA-6j22-wv8g-894f
