CVE-2024-53412 NietThijmen ShoppingCart: Command injection in the connect function
Attackers can execute arbitrary shell commands via the Port field in the connect function, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53412?
CVE-2024-53412 is a high-severity command injection vulnerability in n/a, published on 15 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code execution via injection of malicious payloads into the Port field
Weakness: CWE-77
Which versions are affected by CVE-2024-53412?
3 open source packages ship an affected version, including github.com/NietThijmen/ShoppingCart.
| Package | Affected | Fixed in |
|---|---|---|
github.com/NietThijmen/ShoppingCart Go | All versions | None |
github.com/NietThijmen/ShoppingCart Go | All versions to 0.0.0-20241101155353-3dd137080276 | None |
github.com/NietThijmen/ShoppingCart Go | All versions to 0.0.0-20241101155353-3dd137080276 | None |
How do I fix CVE-2024-53412?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-53412 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-53412 exists.
Sources
Also known as GHSA-ggmw-mjhv-75rm, GO-2026-5398.