{"id":"CVE-2024-35058","kind":"vulnerability","aliases":["CVE-2024-35058","GHSA-4gxj-5mmr-7pxq"],"related":[],"title":"NASA AIT-Core vulnerable to remote code execution","description":"An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string.","summary":"NASA AIT-Core, a Python package for spacecraft ground-systems testing, has a flaw in its API wait function that lets an attacker run arbitrary code by supplying a crafted string. The sources list the affected range as up to and including 2.5.2 and do not say which release fixes it.","severity":"critical","cvss":7.5,"epss":0.00443,"exploited":false,"exploited_at":null,"products":[{"name":"ait-core","fixed":[],"affected":"<= 2.5.2","ecosystem":"pypi"},{"name":"nasa ait core","fixed":[],"affected":"<= 2.5.2","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ait-core","cwe-319","ground-systems","nasa","package","pypi","python"],"not_affected_if":["unknown"],"how_to_check":"- Run `pip show ait-core` and check whether the installed version is `2.5.2` or lower.\n- Search your Python environments and lock files for `ait-core` to find every place it is installed.","fix":"- Upgrade `ait-core` to a release newer than `2.5.2`; the fixed version is unknown from the sources, so check the GHSA advisory for the patched release.\n- Until upgraded, unknown whether disabling the API wait function or restricting input is a viable workaround.","status":"open","published_at":"2024-05-21T18:15:09+00:00","first_seen_at":"2026-10-26T21:21:58+00:00","triaged_at":"2026-10-26T21:32:01+00:00","updated_at":"2026-10-26T21:55:22+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T21:32:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `ait-core` to a release newer than `2.5.2`; the fixed version is unknown from the sources, so check the GHSA advisory for the patched release.\n- Until upgraded, unknown whether disabling the API wait function or restricting input is a viable workaround.","reach":"unknown","title":"NASA AIT-Core: crafted string in API wait function allows code execution","impact":"high","summary":"NASA AIT-Core, a Python package for spacecraft ground-systems testing, has a flaw in its API wait function that lets an attacker run arbitrary code by supplying a crafted string. The sources list the affected range as up to and including 2.5.2 and do not say which release fixes it.","category":"package","nicknames":[],"who_cares":["python","pypi","ait-core","nasa","ground-systems"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the host running ait-core.","analyst_note":"Confirm the fixed version and the exact trigger path for the API wait function in the GHSA-4gxj-5mmr-7pxq advisory, since the sources only give a one-line description and an unknown fix version.","how_to_check":"- Run `pip show ait-core` and check whether the installed version is `2.5.2` or lower.\n- Search your Python environments and lock files for `ait-core` to find every place it is installed.","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that install the pypi package ait-core at version 2.5.2 or earlier and use its API wait function with input that can come from outside. The sources do not say how much of the package or which deployments reach that function, so teams that only use ait-core locally with trusted input are probably less exposed. unknown whether the sources describe other exposed configurations.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000659,"input_tokens":3307,"output_tokens":656,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2024':11A,19A '-319':31B '-35058':12A,20A '2.5.2':83B '4gxj':15A '5mmr':16A '7pxq':17A 'affect':76B 'ait':3A,22A,25A,28B,41B,101C 'ait-cor':2A,27B,40B,100C 'ait-core':21A 'allow':104C 'api':57B,95C 'arbitrari':65B,108C 'attack':63B,105C 'code':8A,66B,109C 'core':4A,23A,26A,29B,42B,102C 'craft':70B,113C 'cve':10A,18A 'cwe':30B 'execut':9A,107C 'fix':90B 'flaw':54B 'function':59B,97C 'ghsa':14A 'ghsa-4gxj-5mmr-7pxq':13A 'ground':33B,49B 'ground-system':32B,48B 'includ':82B 'issu':92C 'let':61B 'list':74B 'nasa':1A,24A,35B,39B,99C 'packag':36B,45B 'pypi':37B 'python':38B,44B 'rang':77B 'releas':89B 'remot':7A 'run':64B 'say':87B 'sourc':73B 'spacecraft':47B 'string':71B,114C 'suppli':68B,111C 'system':34B,50B 'test':51B 'v2.5.2':103C 'via':110C 'vulner':5A 'wait':58B,96C","nicknames":[],"mitigations":[],"who_affected":"Teams that install the pypi package ait-core at version 2.5.2 or earlier and use its API wait function with input that can come from outside. The sources do not say how much of the package or which deployments reach that function, so teams that only use ait-core locally with trusted input are probably less exposed. unknown whether the sources describe other exposed configurations.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-05-21T18:15:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-4gxj-5mmr-7pxq","url":"https://github.com/advisories/GHSA-4gxj-5mmr-7pxq","severity":"critical","published_at":"2024-05-21T18:31:24+00:00","modified_at":"2026-10-26T21:19:26+00:00","first_seen_at":"2026-10-26T21:21:58+00:00","fetched_at":"2026-10-26T21:21:58+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-35058","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35058","severity":null,"published_at":"2024-05-21T18:15:09+00:00","modified_at":"2026-06-17T07:34:19+00:00","first_seen_at":"2026-10-26T21:55:22+00:00","fetched_at":"2026-10-26T21:55:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}