All vulnerabilities
CVE-2024-35059GHSA-jqff-8g2v-642hPYSEC-2026-264

NASA AIT-Core vulnerable to remote code execution

n/a ait-corepipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.45%Chance of exploitation activity in the next 30 days, higher than 39% of CVEs. Scored 26 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published21 May 2024Updated 26 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands.

Text from CVE List

Affected versions 23

  • ait-core, pip<= 2.5.2GitHub
  • n/aaffected: n/aCVE List
  • ait-core, PyPIfrom first release, through 2.5.2OSV
  • ait-core, PyPI1.0.0OSV
  • ait-core, PyPI1.1.0OSV
  • ait-core, PyPI1.2.0OSV
  • ait-core, PyPI1.3.0OSV
  • ait-core, PyPI1.4.0OSV
  • ait-core, PyPI2.0.0OSV
  • ait-core, PyPI2.0.1OSV
  • ait-core, PyPI2.0rc1.dev0OSV
  • ait-core, PyPI2.1.0OSV
  • ait-core, PyPI2.2.0OSV
  • ait-core, PyPI2.3.0OSV
  • ait-core, PyPI2.3.1OSV
  • ait-core, PyPI2.3.2OSV
  • ait-core, PyPI2.3.3OSV
  • ait-core, PyPI2.3.4OSV
  • ait-core, PyPI2.3.5OSV
  • ait-core, PyPI2.4.0OSV
  • ait-core, PyPI2.5.0OSV
  • ait-core, PyPI2.5.1OSV
  • ait-core, PyPI2.5.2OSV

References 5