What is the CVSS score of CVE-2026-72579?

CVE-2026-72579 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of NASA HyperCP are affected by CVE-2026-72579?

NASA HyperCP data download tool contains a command injection vulnerability enabling arbitrary code execution on researcher workstations when attackers intercept network responses.

How to fix or mitigate CVE-2026-72579?

Within 24 hours: inventory all HyperCP installations across research institutions and restrict network access for data downloads to controlled, monitored pathways. Within 7 days: implement network-based detection for suspicious HyperCP traffic patterns and review access logs for indicators of compromise. Within 30 days: establish technical controls including network segmentation for research workstations, evaluate alternative data access methods pending vendor guidance, and conduct incident response tabletop for affected institutions.

NASA HyperCP CVE-2026-72579

EUVD-2026-55227 HIGH

OS Command Injection (CWE-78)

2026-08-10 TuranSec

GHSA-x6m6-xccc-227g

Command Injection Hypercp Nasa

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Description explicitly states network-adjacent MitM requirement, warranting AV:A over the provided AV:N; AC:H reflects server-spoofing prerequisite; UI:R for required download trigger.

3.1 AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 11:22 vuln.today

CVE Published

Aug 10, 2026 - 10:41 cve.org

HIGH 7.5

DescriptionCVE.org

An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation. The Source/OBPGSession.py handler parses server response headers without sanitization and passes attacker-controlled field values to subprocess calls, enabling arbitrary command execution when a user performs a data download operation against a tampered server.

AnalysisAI

OS command injection in NASA HyperCP's OBPGSession.py enables arbitrary code execution on a researcher's workstation when a network-adjacent attacker spoofs or intercepts responses from oceandata.sci.gsfc.nasa.gov. The vulnerable handler passes unsanitized server response header fields directly to subprocess calls, meaning a MitM-positioned attacker can achieve full compromise of the victim machine by injecting shell metacharacters into crafted HTTP response headers during any HyperCP data download operation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-adjacent attack vector combined with complete C/I/A impact makes this a critical threat for research institutions operating on untrusted or shared networks.

Technical ContextAI

HyperCP is a NASA-developed Python scientific data processing application for hyperspectral ocean color and bio-optical research. The affected component, Source/OBPGSession.py, handles communication with the NASA Ocean Biology Processing Group (OBPG) data server at oceandata.sci.gsfc.nasa.gov. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) applies: the handler extracts field values from server-supplied response headers and passes them as arguments to Python subprocess calls without stripping or escaping shell metacharacters. Because subprocess invocation is the sink and the header value is the untrusted source, an attacker who controls the server-side response - via ARP spoofing, DNS poisoning, rogue Wi-Fi access point, or BGP hijack - can append arbitrary shell commands to the injected header value. The CPE string cpe:2.3:a:nasa:hypercp:*:*:*:*:*:*:*:* with wildcard version indicates all known releases of the main branch are affected.

RemediationAI

No vendor-released patch or fixed version has been identified at time of analysis; the upstream fix, if any, would require sanitizing or parameterizing the subprocess calls in Source/OBPGSession.py to prevent shell injection from server-supplied header values (for example, using subprocess argument lists rather than shell=True, and stripping shell metacharacters from all header-derived values). As an immediate compensating control, researchers should restrict HyperCP data download operations to trusted, isolated networks - avoid executing downloads over public Wi-Fi, conference networks, or any shared segment where a network-adjacent attacker could inject traffic. Enforcing strict TLS certificate validation against oceandata.sci.gsfc.nasa.gov (pinning or enforcing system CA trust) would raise the bar for spoofing attacks; disabling this feature if not natively enforced by the application would eliminate the attack surface at the cost of preventing legitimate data downloads. Organizations should monitor the upstream repository at https://github.com/nasa/HyperCP for commits to OBPGSession.py that address this issue.