diff --git a/app/controllers/cart_controller.rb b/app/controllers/cart_controller.rb
index f4ab6abf29..f3a0de59ea 100644
--- a/app/controllers/cart_controller.rb
+++ b/app/controllers/cart_controller.rb
@@ -50,7 +50,8 @@ class CartController < BaseController
 
   def populate_variant_attributes_from_variant(order)
     params[:variant_attributes].each do |variant_id, attributes|
-      order.set_variant_attributes(Spree::Variant.find(variant_id), attributes)
+      permitted = attributes.permit(:quantity, :max_quantity).to_h.with_indifferent_access
+      order.set_variant_attributes(Spree::Variant.find(variant_id), permitted)
     end
   end
 
diff --git a/spec/controllers/cart_controller_spec.rb b/spec/controllers/cart_controller_spec.rb
index 8605dc8adf..b3f6d46c8f 100644
--- a/spec/controllers/cart_controller_spec.rb
+++ b/spec/controllers/cart_controller_spec.rb
@@ -110,11 +110,11 @@ describe CartController, type: :controller do
       order = subject.current_order(true)
       allow(order).to receive(:distributor) { distributor }
       allow(order).to receive(:order_cycle) { order_cycle }
-      expect(order).to receive(:set_variant_attributes).with(variant, max_quantity: '3')
+      expect(order).to receive(:set_variant_attributes).with(variant, max_quantity: "3")
       allow(controller).to receive(:current_order).and_return(order)
 
       expect do
-        spree_post :populate, variants: { variant.id => 1 }, variant_attributes: { variant.id => { max_quantity: 3 } }
+        spree_post :populate, variants: { variant.id => 1 }, variant_attributes: { variant.id => { max_quantity: "3" } }
       end.to change(Spree::LineItem, :count).by(1)
     end
   end