Improper Control of Generation of Code ('Code Injection') Affecting ait-core package, versions [0,]
Threat Intelligence
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-AITCORE-6969136
- published 22 May 2024
- disclosed 21 May 2024
- credit Andy Olchawa, Milenko Starcik
Introduced: 21 May 2024
CVE-2024-35058 Open this link in a new tabHow to fix?
There is no fixed version for ait-core.
Overview
ait-core is a NASA JPL's Ground Data System toolkit for Instrument and CubeSat Missions
Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') in the wait function. An attacker can execute arbitrary code by supplying a crafted string.
Note: Although the eval function is handy, it is inherently insecure. It is recommended to use third-party libraries that provide the same functionality but sanitise the input to handle expression evaluation securely.
References
CVSS Scores
version 3.1