# CVE-2026-21719: An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative…

Source: https://junglewise.ai/threats/cve-2026-21719-an-os-command-injection-vulnerability-exists-in-cubecart-prior-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-17  
License: CC BY 4.0 with a link back

CVE-2026-21719 · Severity: high · CVSS 7.2 · Published 2026-04-17

An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command.

Technologies: [CubeCart](https://junglewise.ai/threats/technologies/cubecart). Vendors: [CubeCart](https://junglewise.ai/threats/vendors/cubecart).

## Quick answers

**Is CVE-2026-21719 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-21719 being exploited in the wild.

**How severe is CVE-2026-21719?** High severity, with a CVSS score of 7.2, published 17 April 2026.

**Which products and versions are affected?** CubeCart. The advisory does not name versions.

**Is there a fix for CVE-2026-21719?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-21719?** Check whether you run CubeCart. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- CubeCart

## Related threats

- [CubeCart broken access control in GDPR customer purge](https://junglewise.ai/threats/cve-2026-54648-cubecart-broken-access-control-in-gdpr-customer-purge)
- [CubeCart SQL injection in download_expire settings parameter](https://junglewise.ai/threats/cve-2026-54647-cubecart-sql-injection-in-download-expire-settings-parameter)
- [CubeCart SQL identifier injection in maintenance tools](https://junglewise.ai/threats/cve-2026-54646-cubecart-sql-identifier-injection-in-maintenance-tools)
- [CubeCart stored XSS in product description fields](https://junglewise.ai/threats/cve-2026-54645-cubecart-stored-xss-in-product-description-fields)
- [CubeCart XSS in GUI messages via unsafe anchor attributes](https://junglewise.ai/threats/cve-2026-54644-cubecart-xss-in-gui-messages-via-unsafe-anchor-attributes)