{"id":"CVE-2024-53412","aliases":["GHSA-ggmw-mjhv-75rm","GO-2026-5398"],"title":"NietThijmen ShoppingCart: Command injection in the connect function","summary":"NietThijmen ShoppingCart: Command injection in the connect function","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"NietThijmen","product":"github.com/NietThijmen/ShoppingCart","ecosystem":"go","affected":["github.com/NietThijmen/ShoppingCart <= 0.0.0-20241101155353-3dd137080276"],"published":"2026-04-15","updated":"2026-07-21","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-ggmw-mjhv-75rm","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53412"},{"url":"https://github.com/NietThijmen/ShoppingCart/issues/1"},{"url":"https://github.com/Buckdray/vulnerability-research/blob/main/CVE-2024-53412/README.md"},{"url":"https://github.com/NietThijmen/ShoppingCart"},{"url":"https://github.com/advisories/GHSA-ggmw-mjhv-75rm"}],"tags":["osv","go"],"epss":0.00558,"epssPercentile":0.44065,"ingestedAt":"2026-07-21T19:04:59.201Z","slug":"CVE-2024-53412","body":"## Overview\n\nCommand injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code execution via injection of malicious payloads into the Port field\n\n## Affected packages\n\n- `github.com/NietThijmen/ShoppingCart <= 0.0.0-20241101155353-3dd137080276`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}