# Reflected XSS in <any>.myshopify.com through theme preview

Reflected XSS via unescaped theme_handle parameter in Shopify theme preview, executing on storefront origin shared with admin.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: zombiehelp54
- Disclosed: 2017-05-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/226428
- Library page: https://bugbountylibrary.com/r/h1%3A226428
- Tags: area:web domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high vuln:xss

**Target:** myshopify.com storefront theme preview endpoint
**Root cause:** The theme preview template failed to escape single quotes in the theme_handle parameter, allowing breakout from a JS string context.
**Steps:**
1. Navigate to <account>.myshopify.com and view source to copy the Shopify.theme Id.
2. Request `https://echo.myshopify.com/?theme_handle=xx%27-alert(document.cookie)-%27&style_id=1&style_handle=1&preview_theme_id=<theme_ID>`.
3. XSS triggers on all online shop pages until 'Cancel theme preview' is clicked.
**How found:** Noticed theme_handle was reflected into a JS string without escaping single quotes, then tested breakout with `'-alert(document.cookie)-'`.
**Exploitation:** Attacker crafts a preview URL with a single-quote breakout in theme_handle; victim visiting it executes JS on the storefront origin, which shares origin with the store admin, enabling attacks against the admin area.
**Escalation:** Same-origin storefront/admin hosting lets storefront XSS pivot to admin area actions.
**Insight:** Theme preview parameters reflected into inline JS strings are prime XSS spots; check quote escaping, and note storefront/admin same-origin hosting to argue higher impact.