{"id":"CVE-2024-35057","kind":"vulnerability","aliases":["CVE-2024-35057","GHSA-jf28-v5f6-cvpr"],"related":[],"title":"NASA AIT-Core vulnerable to remote code execution","description":"An issue in NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via a crafted packet.","summary":"NASA AIT-Core, a Python package for telemetry and command handling, can be made to execute arbitrary code through a crafted packet. An attacker who can send that packet to a vulnerable instance gets code execution on the host running it.","severity":"critical","cvss":7.5,"epss":0.00438,"exploited":false,"exploited_at":null,"products":[{"name":"ait-core","fixed":[],"affected":"<= 2.5.2","ecosystem":"pypi"},{"name":"nasa ait core","fixed":[],"affected":"<= 2.5.2","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ait-core","cwe-319","package","pypi","python","self-hosted"],"not_affected_if":[],"how_to_check":"- Run `pip show ait-core` and look at the version; the sources say versions up to `2.5.2` are affected.\n- Check whether your deployment listens for packets from the network (the sources do not say which interface or port).","fix":"- Upgrade `ait-core` to a version newer than `2.5.2`; the sources do not name the exact fixed version.\n- unknown","status":"open","published_at":"2024-05-21T18:15:09+00:00","first_seen_at":"2026-10-26T21:16:46+00:00","triaged_at":"2026-10-26T21:17:02+00:00","updated_at":"2026-10-26T21:20:32+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T21:17:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `ait-core` to a version newer than `2.5.2`; the sources do not name the exact fixed version.\n- unknown","reach":"network","title":"NASA AIT-Core: crafted packet lets attackers execute arbitrary code","impact":"high","summary":"NASA AIT-Core, a Python package for telemetry and command handling, can be made to execute arbitrary code through a crafted packet. An attacker who can send that packet to a vulnerable instance gets code execution on the host running it.","category":"package","nicknames":[],"who_cares":["python","pypi","ait-core","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the host via a crafted packet","analyst_note":"Find the GHSA-jf28-v5f6-cvpr advisory text for the fixed version, the affected packet path, and whether auth is needed.","how_to_check":"- Run `pip show ait-core` and look at the version; the sources say versions up to `2.5.2` are affected.\n- Check whether your deployment listens for packets from the network (the sources do not say which interface or port).","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running the pypi package ait-core at version 2.5.2 or earlier, most likely in ground-system or telemetry setups. The sources do not say which configurations expose the packet handling, so whether a given deployment is reachable is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000601,"input_tokens":3297,"output_tokens":543,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2024':11A,19A '-319':31B '-35057':12A,20A 'ait':3A,22A,25A,28B,40B,84C 'ait-cor':2A,27B,39B,83C 'ait-core':21A 'allow':87C 'arbitrari':55B,91C 'attack':62B,88C 'code':8A,56B,73B,92C 'command':48B 'core':4A,23A,26A,29B,41B,85C 'craft':59B,95C 'cve':10A,18A 'cvpr':17A 'cwe':30B 'execut':9A,54B,74B,90C 'get':72B 'ghsa':14A 'ghsa-jf28-v5f6-cvpr':13A 'handl':49B 'host':37B,77B 'instanc':71B 'issu':80C 'jf28':15A 'made':52B 'nasa':1A,24A,38B,82C 'packag':32B,44B 'packet':60B,67B,96C 'pypi':33B 'python':34B,43B 'remot':7A 'run':78B 'self':36B 'self-host':35B 'send':65B 'telemetri':46B 'v2.5.2':86C 'v5f6':16A 'via':93C 'vulner':5A,70B","nicknames":[],"mitigations":[],"who_affected":"Teams running the pypi package ait-core at version 2.5.2 or earlier, most likely in ground-system or telemetry setups. The sources do not say which configurations expose the packet handling, so whether a given deployment is reachable is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-05-21T18:15:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-jf28-v5f6-cvpr","url":"https://github.com/advisories/GHSA-jf28-v5f6-cvpr","severity":"critical","published_at":"2024-05-21T18:31:24+00:00","modified_at":"2026-10-26T21:13:32+00:00","first_seen_at":"2026-10-26T21:16:46+00:00","fetched_at":"2026-10-26T21:16:46+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-35057","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35057","severity":null,"published_at":"2024-05-21T18:15:09+00:00","modified_at":"2026-06-17T07:34:19+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}