CVE-2026-39862 Details
Description
Tophat is a mobile applications testing harness. Prior to 2.5.1, Tophat is affected by remote code execution via crafted tophat:// or http://localhost:29070 URLs. The arguments query parameter flows unsanitized from URL parsing through to /bin/bash -c execution, allowing an attacker to execute arbitrary commands on a developer's macOS workstation. Any developer with Tophat installed is vulnerable. For previously trusted build hosts, no confirmation dialog appears. Attacker commands run with the user's permissions. This vulnerability is fixed in 2.5.1.
A remote code execution vulnerability exists in Tophat versions prior to 2.5.1. The issue arises because the 'arguments' query parameter is passed unsanitized from URL parsing to execution via '/bin/bash -c'. This allows an attacker to execute arbitrary commands on a developer's macOS workstation. The vulnerability is triggered by crafted 'tophat://' or 'http://localhost:29070' URLs. Commands executed through this vulnerability run with the user's permissions. Developers with Tophat installed are affected, and for previously trusted build hosts, no confirmation dialog is presented.
Users are advised to update Tophat to version 2.5.1 or later. If an immediate update is not possible, manually inspect all Tophat URLs for malicious arguments before clicking.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Shopify/tophat/pull/139 | [email protected] | Issue Tracking |
| https://github.com/Shopify/tophat/security/advisories/GHSA-8x8g-6rv5-mgg2 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| shopify tophat | < 2.5.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 8, 2026 | New CVE Received | [email protected] |