CVE-2026-72579: NASA HyperCP - OS Command Injection via Malicious HTTP Response from Data Server
An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72579?
The severity of CVE-2026-72579 is classified as high with a score of 7.5.
How do I fix CVE-2026-72579?
To fix CVE-2026-72579, ensure that your NASA HyperCP installation is updated to the latest version that addresses OS command injection vulnerabilities.
What types of attacks can be carried out due to CVE-2026-72579?
CVE-2026-72579 allows attackers to execute arbitrary system commands on a researcher's workstation through OS command injection.
Who is affected by CVE-2026-72579?
Users of NASA HyperCP who can access the Data Server and have network adjacency are affected by CVE-2026-72579.
What causes CVE-2026-72579?
CVE-2026-72579 is caused by improper parsing of server responses in the Source/OBPGSession.py handler allowing command injection.