What should Shopify teams do about it?

Update Shopify CLI immediately to patch command injection vulnerability • If deploying new themes with color_palette settings, upgrade to get the schema upload fix

CRITICAL COMMAND INJECTION IN SHOPIFY CLI — PATCH IMMEDIATELY

By RepoJournal · Filed 06:03 UTC on May 9, 2026 · About Shopify

Shopify CLI's process killer contains a command injection vulnerability on Windows that lets attackers execute arbitrary commands through a malicious PID string.

The vulnerability [1] lives in the treeKill utility, where insufficient PID validation combined with shell-interpreted `child_process.exec` calls opened a direct path to code execution. The fix [2] replaces the broken Number.isNaN check with strict regex validation and swaps exec for spawn to prevent argument interpretation. This is the kind of dormant-until-discovered flaw that affects every developer using the CLI on Windows — upgrade before your next theme push or app deployment.

Beyond the security work, the team spent the last 24 hours hardening test infrastructure and fixing runtime detection. The file watcher now catches new files added during dev sessions [3], which actually matters because files created after startup were silently dropped by the watcher. The test suite is shifting away from filesystem mocks toward real temporary directories , a pattern that catches more bugs in practice. These aren't headline moves, but they're the kind of foundational work that prevents hours of debugging later.

One more fix landed for theme pushes: settings_schema.json now uploads before validator-consumer assets [4], which unblocks fresh dev theme deploys that use the new color_palette setting type. If you've hit the "first push fails, second push works" wall, this is your fix.

FAQ

What changed in Shopify on May 9, 2026?: Shopify CLI's process killer contains a command injection vulnerability on Windows that lets attackers execute arbitrary commands through a malicious PID string.
What should Shopify teams do about it?: Update Shopify CLI immediately to patch command injection vulnerability • If deploying new themes with color_palette settings, upgrade to get the schema upload fix
Which Shopify repositories shipped on May 9, 2026?: Shopify/cli

CRITICAL COMMAND INJECTION IN SHOPIFY CLI — PATCH IMMEDIATELY

The showcase is a teaser. Your wire is the product.

The showcase is a teaser.
Your wire is the product.