# Stored XSS in *.myshopify.com

Stored XSS in Shopify Theme Editor: HTML typed into the announcement text field was parsed into the admin DOM, executing script in the admin context.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: jamesclyde
- Disclosed: 2017-06-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/241008
- Library page: https://bugbountylibrary.com/r/h1%3A241008
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium technique:source-review vuln:xss

**Target:** Theme Editor input field (announcement text) in *.myshopify.com admin
**Root cause:** Sanitization code attempted to fix unclosed HTML tags by assigning user input to `document.createElement('div').innerHTML` on onblur/onchange, instantiating HTML (and event handlers) into the admin document DOM.
**Steps:**
1. Go to `https://(YOUR SHOP).myshopify.com/admin/themes/(THEME id)/editor`
2. Select header and scroll to 'announcement text'
3. Enter payload `"><img src="x" onerror="alert(document.cookie)">`
4. Click save; the onerror fires and XSS executes in the admin section
**How found:** Researcher noted the storefront-iframe exclusion and tested the Theme Editor admin input, observing HTML typed into the field was instantiated in the DOM.
**Exploitation:** Attacker-controlled HTML stored in the theme's announcement text is parsed into the admin DOM when the field's onblur/onchange triggers the sanitizer, executing the img onerror handler in the admin context (cookie access).
**Insight:** Sanitizers that 'fix' unclosed tags by assigning input to innerHTML of a detached element still parse and can instantiate event handlers; test admin-side input fields that re-render on blur/change, not just the storefront.