Nasa Fprime-gds vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Nasa Fprime-gds: 1 record(s), with affected versions and fixes.

CVE-2026-72577 Critical · 9.8 CWE-306 Aug 10, 2026

NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint.