NASA AIT-GUI Flaws Allow Unauthenticated Spacecraft Command Execution

Critical Vulnerabilities Discovered in NASA/JPL's AIT-GUI

Security researchers at Cycode have identified a series of critical flaws within AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit. These vulnerabilities could enable an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The issue is tracked as GHSA-p9r8-2q67-fp86 and has a CVSS v3.1 score of 9.4.

Affected Versions and Patch

The identified vulnerabilities impact AIT-GUI versions 2.5.1 and earlier. NASA/JPL has addressed these flaws in version 2.5.2 of the software. The advisory, published on August 13, 2026, notes that no CVE has been assigned to this specific chain of flaws.

Technical Details of the Exploits

The AMMOS Instrument Toolkit provides a framework for building ground data systems that manage commands to spacecraft and instruments. AIT-GUI serves as its operator console. The vulnerabilities stem from the AIT-GUI web server binding to 0.0.0.0 on port 8080 by default and exposing state-changing routes without authentication, authorization, or CSRF protection. This allows an unauthenticated party to issue arbitrary instrument and spacecraft commands via POST /cmd, execute server-side scripts via POST /script/run (including path traversal), and run command sequences via POST /seq.

The routes accept application/x-www-form-urlencoded bodies, which browsers treat as CORS 'simple' requests. This means a cross-origin POST can reach them without a preflight, making even host-local or firewalled deployments exploitable if an operator visits a malicious page.

Impact on Spacecraft Operations

The potential impact of these flaws is significant, as an attacker could directly issue commands to spacecraft and instruments. Cycode emphasized that the 'blast radius of an unauthenticated POST is measured in issued instrument commands, not defaced pages.' The vulnerabilities are classified under CWE-306 (Missing Authentication for Critical Function), CWE-352 (Cross-Site Request Forgery), and CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).