A critical OS command injection vulnerability has been identified in Shibby Tomato version 1.28.0000. The vulnerability exists in the function new_qoslimit_start within the file /etc/qoslimit. An attacker can manipulate the argument new_qoslimit_enable to inject arbitrary OS commands. The attack can be initiated remotely without requiring physical access. A public exploit is already available, increasing the risk of active exploitation. The affected product, Shibby Tomato, is a router firmware project that has since been superseded by FreshTomato. Users are advised to migrate to FreshTomato or apply any available mitigations. The vulnerability has been catalogued in VulDB and the NVD.