GHSA-ggmw-mjhv-75rm

Source

https://github.com/advisories/GHSA-ggmw-mjhv-75rm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-ggmw-mjhv-75rm/GHSA-ggmw-mjhv-75rm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-ggmw-mjhv-75rm

Aliases

CVE-2024-53412
GO-2026-5398

Published

2026-04-15T15:31:43Z

Modified

2026-07-21T15:00:40Z

Severity

8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

NietThijmen ShoppingCart: Command injection in the connect function

Details

Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code execution via injection of malicious payloads into the Port field

Database specific

{
    "cwe_ids":  [
        "CWE-77"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-16T21:26:36Z",
    "nvd_published_at":  "2026-04-15T15:16:39Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / github.com/NietThijmen/ShoppingCart

Package

Name: github.com/NietThijmen/ShoppingCart; View open source insights on deps.dev
Purl: pkg:golang/github.com/NietThijmen/ShoppingCart

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

0.0.0-20241101155353-3dd137080276

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-ggmw-mjhv-75rm/GHSA-ggmw-mjhv-75rm.json"