Live › vulnerability › CVE-2024-35056
Go to dashboardNASA AIT-Core, a Python package for ground systems telemetry, builds SQL statements from input in its query_packets and insert functions without parameterization. An attacker who can supply input to those functions can read or change the database contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:16 UTC, 0h before NVD. All times on this page are UTC.
Teams that use the pypi package ait-core at version 2.5.2 or earlier and pass externally influenced values into its query_packets or insert functions. Systems that use the package only with fixed internal inputs are less exposed, but the sources do not say how far that reduces risk. Teams not using ait-core can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ait-core | pypi | <= 2.5.2 | – |
| nasa ait core | vendor | <= 2.5.2 | – |
pip show ait-core and compare the version against 2.5.2query_packets or insert from ait-core that take untrusted inputait-core to a version newer than 2.5.2; the fixed version is unknown from the sourcesquery_packets and insertEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the query_packets and insert functions.
This page as .md · .json · in your agent: get_signal("CVE-2024-35056")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.