Security researchers at Cycode have disclosed a serious vulnerability chain in AIT-GUI, the browser-based operator console for the open-source AMMOS Instrument Toolkit developed by NASA and JPL. Tracked as GHSA-p9r8-2q67-fp86 with a CVSS v3.1 rating of 9.4, the security issue allows unauthenticated remote attackers to issue arbitrary commands directly to a spacecraft or instrument command bus. The toolkit serves as a foundational ground data system used to process incoming telemetry and transmit crucial operational instructions. The underlying defect stems from the AIT-GUI web server reading its host configuration setting but discarding it, causing the service to automatically bind to all network interfaces on port 8080 without enforcing authentication, authorization, or cross-site request forgery protections on state-changing endpoints.
The flaws, classified under CWE-306, CWE-352, and CWE-22, expose critical routes that allow remote actors to run server-side scripts, transmit spacecraft operational sequences, and execute path traversal attacks outside of intended project directories. Because state-changing endpoints accept standard web form submissions, browsers handle them without triggering preliminary security checks. This behavior enables cross-origin attacks, meaning an operator simply visiting an untrusted website while running the console could inadvertently allow a malicious page to transmit unauthenticated commands to target systems. The issue impacts all software iterations up to version 2.5.1.
In response to the disclosure, developers released version 2.5.2 to mitigate cross-origin browser requests and restrict script directory paths. However, subsequent code audits revealed that state-changing routes still issue session tokens without requiring proper credential checks, leaving the endpoints accessible without direct authentication. A parallel vulnerability entry, tracked as CVE-2026-60112 with a CVSS v4 score of 9.3, similarly documents the missing authentication issue across the project codebase.
The security findings highlight broader challenges within open-source aerospace software, as multiple unreviewed advisory records currently affect related NASA ground system tools, including path traversal issues in AIT-Core and sequencing tools. Security researcher Yuval Elbar derived the patch using AI-assisted code analysis alongside human research methods, adding automated regression testing to prevent future security regressions. While no active exploitation or compromised missions have been reported, operators running affected ground station environments are advised to enforce strict network isolation and update their installations immediately.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
