CVE-2026-72577 NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...

CVE-2026-72577: Missing Authentication for Critical Function

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...

PT-2026-69461

Name of the Vulnerable Software and Affected Versions NASA fprime-gds versions prior to 3.4.4 Description An unauthenticated remote attacker can achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime...

fprime-ci (0.0.1a1), fprime-fpy (>=0.0.1a1, <=0.3.2) +1 more potentially affected by CVE-2024-55029 via fprime-gds (4.3.0)

fprime-gds PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on fprime-gds and may be impacted: - fprime-ci 0.0.1a1 - fprime-fpy =0.0.1a1, =0.1.0, =0.1.5 Source cves: CVE-2024-55029 Source advisory: SNYK:PYTHON-FPRIMEGDS-9749311...

fprime-ci (0.0.1a1), fprime-fpy (>=0.0.1a1, <=0.3.2) +1 more potentially affected by CVE-2024-55030 via fprime-gds (4.3.0)

fprime-gds PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on fprime-gds and may be impacted: - fprime-ci 0.0.1a1 - fprime-fpy =0.0.1a1, =0.1.0, =0.1.5 Source cves: CVE-2024-55030 Source advisory: SNYK:PYTHON-FPRIMEGDS-9749309...

Insecure Defaults

Overview fprime-gds is a F Prime Flight Software Ground Data System layer Affected versions of this package are vulnerable to Insecure Defaults by repeated invocation of sendcommand, which can overflow the queue and consume excessive memory. Remediation There is no fixed version for fprime-gds...

fprime-ci (0.0.1a1), fprime-fpy (>=0.0.1a1, <=0.3.2) +1 more potentially affected by CVE-2024-55028 via fprime-gds (4.3.0)

fprime-gds PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on fprime-gds and may be impacted: - fprime-ci 0.0.1a1 - fprime-fpy =0.0.1a1, =0.1.0, =0.1.5 Source cves: CVE-2024-55028 Source advisory: SNYK:PYTHON-FPRIMEGDS-9749306...