Threats affecting pkg:github/shopify/tophat

CVE-2026-39862 is an OS command injection vulnerability in Shopify's Tophat mobile application testing harness versions prior to 2.5.1. The vulnerability allows remote code execution via crafted tophat:// or http://localhost:29070 URLs, where the arguments query parameter is unsanitized and passed directly to a bash shell command. This enables an attacker to execute arbitrary commands on a developer's macOS workstation with the user's permissions, without any confirmation dialog for previously trusted build hosts. The issue is fixed in version 2.5.1.