XSS *.myshopify.com/collections/vendors?q=

Summary

@gromoza reported a reflected cross-site scripting vulnerability that affected some Shopify storefronts. The vulnerability resulted from improper handling of the q parameter, which was not properly escaped when placed into the collection object in Liquid. As a result, stores that included collection.title in an HTML attribute would be vulnerable to reflected cross-site scripting. A reflected cross-site scripting vulnerability in the storefront could be used by unauthenticated users to attack the admin area of a store, given that the storefront is hosted on the same origin as the admin area of a store.