---
id: CVE-2024-53412
aliases:
  - GHSA-ggmw-mjhv-75rm
  - GO-2026-5398
title: 'NietThijmen ShoppingCart: Command injection in the connect function'
summary: 'NietThijmen ShoppingCart: Command injection in the connect function'
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: NietThijmen
product: github.com/NietThijmen/ShoppingCart
ecosystem: go
affected:
  - github.com/NietThijmen/ShoppingCart <= 0.0.0-20241101155353-3dd137080276
published: '2026-04-15'
updated: '2026-07-21'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-ggmw-mjhv-75rm'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-53412'
  - url: 'https://github.com/NietThijmen/ShoppingCart/issues/1'
  - url: >-
      https://github.com/Buckdray/vulnerability-research/blob/main/CVE-2024-53412/README.md
  - url: 'https://github.com/NietThijmen/ShoppingCart'
  - url: 'https://github.com/advisories/GHSA-ggmw-mjhv-75rm'
tags:
  - osv
  - go
epss: 0.00558
epssPercentile: 0.44141
ingestedAt: '2026-07-21T19:04:59.201Z'
---

## Overview

Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code execution via injection of malicious payloads into the Port field

## Affected packages

- `github.com/NietThijmen/ShoppingCart <= 0.0.0-20241101155353-3dd137080276`

## Remediation

Refer to the advisory for the patched release.