CVE-2025-66572 describes a client-side template injection vulnerability in Loaded Commerce 6.6. The vulnerability arises from improper neutralization of special elements in the search parameter, enabling unauthenticated attackers to execute arbitrary code within the victim's browser context when they visit a specially crafted URL. This is categorized under CWE-78, indicating an OS command injection risk, though the actual impact is on client-side code execution rather than server-side command execution. The CVSS 4.0 vector indicates the attack requires no privileges or user interaction and has low to low scope and impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary code in the victim's browser context, potentially leading to client-side compromise such as theft of session data or execution of malicious scripts. The vulnerability does not require user interaction or privileges, increasing its risk. However, the impact is limited to the client side and does not directly affect the server or backend systems. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid visiting untrusted or suspicious URLs containing the search parameter in Loaded Commerce 6.6. Monitoring vendor channels for updates is recommended.