Command injection in a scientific analysis tool
A concise example of why file-derived metadata must not cross into shell interpretation. The useful lesson is the boundary: untrusted input should remain data through parsing and process launch.
- Original severity
- P1 source-reported; not rescored by vulns.co
- Public source
- bugcrowd crowdstream
- Program / vendor
- National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
- Product / surface
- OCSSW Matchup Tools
- Weakness
- OS command injection
- Affected boundary
- Unauthenticated processing of supplied analysis input
- Disclosure date
- 2026-07-02
- Public status checked
- 2026-09-10
- Public attribution
- KaranKurani
What the evidence established
The public disclosure describes controlled confirmation of input reaching a command-execution boundary without accessing NASA systems.
Why the impact was credible
The source reported potential arbitrary command execution in the affected analysis environment.
Durable engineering lesson
A concise example of why file-derived metadata must not cross into shell interpretation. The useful lesson is the boundary: untrusted input should remain data through parsing and process launch.
Control pattern
Treat supplied values as data, use structured process arguments, and apply allowlist validation before execution.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.