An OS command injection vulnerability exists in CubeCart prior to version 6.6.0. This flaw permits an authenticated user with administrative privileges to inject and execute arbitrary OS commands on the underlying system. The vulnerability is classified as high severity with a CVSS 3.0 score of 7.2, reflecting network attack vector, low attack complexity, required privileges at the high level, no user interaction, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker with administrative access to execute arbitrary operating system commands, potentially leading to full system compromise including unauthorized data access, modification, or service disruption. The impact affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted users only and monitor for suspicious activity related to command execution. Avoid exposing administrative interfaces to untrusted networks.