Arbitrary Code Execution Vulnerability in Job Iteration API for ActiveJob by Shopify

CVE-2025-53623

What is CVE-2025-53623?

The Job Iteration API, an extension for ActiveJob, is affected by a vulnerability in the CsvEnumerator class that allows for arbitrary code execution. Attackers can exploit this vulnerability to execute unauthorized commands on the server where the application is hosted, potentially leading to data leakage or complete system takeover. This issue has been patched in version 1.11.0 and later. Users are advised to refrain from using untrusted inputs within the CsvEnumerator class and to ensure that file paths are rigorously sanitized before processing them. Caution is particularly recommended with the count_of_rows_in_file method when handling untrusted CSV filenames.

References