ShopXO RCE VulnerabilityGHSA-xx77-w6p5-xvmj
CRITICALGHSA-xx77-w6p5-xvmj is a critical-severity (CVSS 9.8) Unrestricted File Upload vulnerability in shopxo/shopxo. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
shopxo/shopxoReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | shopxo/shopxo | all versions | No fix |
Affected Products
shopxoshopxoDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for shopxo/shopxo, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
The records we use list no patched version of shopxo/shopxo for GHSA-xx77-w6p5-xvmj. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.
Mitigate without a patch
Treat uploaded files as untrusted until proven otherwise: validate the actual content type rather than the supplied extension, store uploads outside the web root on a volume mounted without execute permission, and rename them to server-generated identifiers so an attacker cannot choose the path a request will later resolve.
Frequently Asked Questions
Is GHSA-xx77-w6p5-xvmj in your dependencies?
Find it across Packagist, including transitive dependencies.