Shopify Tophat versions before 2.5.1 contain an OS command injection vulnerability (CWE-78) due to improper neutralization of special elements in the arguments query parameter. The parameter is parsed from crafted URLs (tophat:// or http://localhost:29070) and passed unsanitized to /bin/bash -c, allowing arbitrary command execution on macOS developer workstations. No user interaction or confirmation is required on previously trusted build hosts. The vulnerability is resolved in Tophat 2.5.1.

An attacker can remotely execute arbitrary commands on a developer's macOS workstation running a vulnerable Tophat version, with the same permissions as the user. This could lead to compromise of the developer environment and potentially the software development process. No known exploits in the wild have been reported. The CVSS 4.0 score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, but requiring privileges and resulting in high impact on confidentiality, integrity, and availability.

Upgrade Tophat to version 2.5.1 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 2.5.1, applying this update fully mitigates the risk. No additional mitigation steps are indicated.