{"id":"CVE-2026-72579","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-72579","summary":"An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute…","details":"An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation. The Source/OBPGSession.py handler parses server response headers without sanitization and passes attacker-controlled field values to subprocess calls, enabling arbitrary command execution when a user performs a data download operation against a tampered server.","published":"2026-08-10T11:17:30.780","modified":"2026-08-10T11:17:30.780","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://github.com/nasa/HyperCP"},{"type":"WEB","url":"https://github.com/nasa/HyperCP/blob/main/Source/OBPGSession.py"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-10T11:17:30.780"}}