This vulnerability is a command injection flaw located in the connect function of NietThijmen ShoppingCart 0.0.2. An attacker can insert arbitrary shell commands into the Port field, allowing them to execute code on the host that runs the application with the process’s privileges. The impact is the ability to modify, delete or exfiltrate data, establish persistence, or pivot to other systems on the network. The weakness is an input validation failure that permits injected shell commands to be interpreted by the system.

The issue affects the open‑source NietThijmen ShoppingCart, version 0.0.2. No other vendors or product versions are currently listed as affected.

The CVSS score of 8.4 indicates a high severity. Current exploitation probability is not specified. Attackers are likely to exploit this vulnerability by sending crafted requests that include malicious payloads in the Port field, triggering arbitrary command execution on the hosting server. No specific prerequisites besides access to the application are disclosed, meaning that the flaw could be abused by unauthenticated users if the Port field is exposed to them.