Live › vulnerability › CVE-2024-35058
Go to dashboardNASA AIT-Core, a Python package for spacecraft ground-systems testing, has a flaw in its API wait function that lets an attacker run arbitrary code by supplying a crafted string. The sources list the affected range as up to and including 2.5.2 and do not say which release fixes it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:21 UTC, 1h before NVD. All times on this page are UTC.
Teams that install the pypi package ait-core at version 2.5.2 or earlier and use its API wait function with input that can come from outside. The sources do not say how much of the package or which deployments reach that function, so teams that only use ait-core locally with trusted input are probably less exposed. unknown whether the sources describe other exposed configurations.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ait-core | pypi | <= 2.5.2 | – |
| nasa ait core | vendor | <= 2.5.2 | – |
pip show ait-core and check whether the installed version is 2.5.2 or lower.ait-core to find every place it is installed.ait-core to a release newer than 2.5.2; the fixed version is unknown from the sources, so check the GHSA advisory for the patched release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string.
This page as .md · .json · in your agent: get_signal("CVE-2024-35058")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.