All vulnerabilities
CVE-2024-35056GHSA-gpgj-xrgw-8mx2PYSEC-2026-262

NASA AIT-Core vulnerable to SQL Injection

n/a ait-corepipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.61%Chance of exploitation activity in the next 30 days, higher than 48% of CVEs. Scored 26 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published21 May 2024Updated 26 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the query_packets and insert functions.

Text from CVE List

Affected versions 23

  • ait-core, pip<= 2.5.2GitHub
  • n/aaffected: n/aCVE List
  • ait-core, PyPIfrom first release, through 2.5.2OSV
  • ait-core, PyPI1.0.0OSV
  • ait-core, PyPI1.1.0OSV
  • ait-core, PyPI1.2.0OSV
  • ait-core, PyPI1.3.0OSV
  • ait-core, PyPI1.4.0OSV
  • ait-core, PyPI2.0.0OSV
  • ait-core, PyPI2.0.1OSV
  • ait-core, PyPI2.0rc1.dev0OSV
  • ait-core, PyPI2.1.0OSV
  • ait-core, PyPI2.2.0OSV
  • ait-core, PyPI2.3.0OSV
  • ait-core, PyPI2.3.1OSV
  • ait-core, PyPI2.3.2OSV
  • ait-core, PyPI2.3.3OSV
  • ait-core, PyPI2.3.4OSV
  • ait-core, PyPI2.3.5OSV
  • ait-core, PyPI2.4.0OSV
  • ait-core, PyPI2.5.0OSV
  • ait-core, PyPI2.5.1OSV
  • ait-core, PyPI2.5.2OSV

References 6