🎯 New Report #2509022: Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image Rendering
🔺Severity: Medium
👽 Reporter: saltymermaid
⭐️ Reputation: 1415
🛠 State: resolved
💼 Team: Shopify
💵 Bounty: 1600
🕐 Submitted: 2024-05-16
⏰ Disclosed: 2026-06-18 12:48:02
📝 Summary: A reflected XSS vulnerability was reported in the AI chat bot greetings at help.shopify.com. The issue was caused by the rendering of a markdown image in the greeting, which allowed the attacker to inject a payload through the image URL. The vulnerability was addressed by removing the attacker-controlled greeting input path.
📂 Report JSON File: 2509022
@hackeronereports