Cycode researcher Yuval Elbar has uncovered a critical vulnerability in NASA/JPL’s open-source AIT-GUI, the browser-based console used to command spacecraft and scientific instruments.
The software shipped without authentication or authorization on sensitive endpoints, potentially allowing an attacker to issue arbitrary commands, run scripts and execute command sequences without credentials. Because it also lacked CSRF protection, an attacker could potentially exploit even a firewalled system simply by getting an operator to visit a malicious webpage.
The vulnerability carries a CVSS score of 9.4 and is tracked as GHSA-p9r8-2q67-fp86. It has been fixed in AIT-GUI 2.5.2.
The blog with full details is here: https://cycode.com/blog/ait-gui-unauthenticated-command-execution
Critical vulnerability in NASA/JPL’s open-source AIT-GUI
Posted in Commentary with tags Cycode on August 18, 2026 by itnerdCycode researcher Yuval Elbar has uncovered a critical vulnerability in NASA/JPL’s open-source AIT-GUI, the browser-based console used to command spacecraft and scientific instruments.
The software shipped without authentication or authorization on sensitive endpoints, potentially allowing an attacker to issue arbitrary commands, run scripts and execute command sequences without credentials. Because it also lacked CSRF protection, an attacker could potentially exploit even a firewalled system simply by getting an operator to visit a malicious webpage.
The vulnerability carries a CVSS score of 9.4 and is tracked as GHSA-p9r8-2q67-fp86. It has been fixed in AIT-GUI 2.5.2.
The blog with full details is here: https://cycode.com/blog/ait-gui-unauthenticated-command-execution
Leave a comment »