Update the vulnerable JavaScript library on Shopify
Why it matters
The page loads a JavaScript library version with a published vulnerability, and attackers scan for these. Updating to the fixed release closes the hole without changing how the site looks.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Look at the script address from the finding. If it points to cdn.shopify.com under /assets/ and is a theme file, the library is part of your theme. Update the theme to its latest version (Online Store, Themes, and use the update option on the theme card), or ask the theme developer for a release that updates it.
- If the address belongs to an app, open Apps and update or replace it. Remove apps you no longer use, and delete any leftover app code from the theme files (Online Store, Themes, Edit code), because an uninstalled app can leave its scripts behind.
- On a custom theme you can replace the file in Assets with a fixed release of the library. Keep a copy of the theme first, and test on a duplicate before publishing.
Related
- Reported by the javascript libraries with known vulnerabilities check
Scan your domain to see whether this applies to you.