Live › vulnerability › CVE-2024-35059
Go to dashboardNASA AIT-Core, a Python package, uses the pickle library in a way that lets an attacker execute arbitrary commands. The sources say the flaw affects version 2.5.2 and earlier, and the advisory rates it critical with a CVSS score of 9.8.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:16 UTC, 0h before NVD. All times on this page are UTC.
Teams that install the ait-core package and run versions 2.5.2 or lower are exposed. The sources do not say which features or data paths trigger the pickle load, so systems that use ait-core on untrusted input should be checked first. Teams without this package in their dependency tree can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ait-core | pypi | <= 2.5.2 | – |
| nasa ait core | vendor | <= 2.5.2 | – |
pip show ait-core and check whether the reported version is 2.5.2 or lowerait-core in requirements or lock filesait-core to a version newer than 2.5.2; the fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands.
This page as .md · .json · in your agent: get_signal("CVE-2024-35059")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.