A flaw in Shopify Tophat allows an attacker to inject shell commands through query parameters that are forwarded to /bin/bash -c during URL parsing. The unsanitized input can trigger arbitrary code execution on a developer's macOS workstation while using any user‑level privileges. The weakness is a classic command injection (CWE‑78).

Developers using Shopify Tophat versions older than 2.5.1 on macOS are affected. The vulnerability is triggered by specially crafted tophat:// or http://localhost:29070 URLs accessed from a web browser. No confirmation dialog appears for previously trusted build hosts, and the local service listening on port 29070 accepts requests from any user’s browser. All installations of Tophat before the 2.5.1 release are susceptible.

The CVSS score of 6.3 indicates medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to supply a malicious link that a developer opens in a browser, which then contacts the local Tophat service and causes unsafe command execution. Based on the description, this is not a direct external network exploitation, but it can be abused through social engineering or phishing. The impact is that executed commands run with the user's permissions, potentially allowing a compromise of the development machine.