Command-injection risk in a trajectory-subsetting service
This is a strong evidence-led case study because the disclosure pairs a narrow proof boundary with a specific defensive pattern: data should be passed as structured arguments, not composed into executable text.
- Original severity
- P1 source-reported; not rescored by vulns.co
- Public source
- bugcrowd crowdstream
- Program / vendor
- National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
- Product / surface
- Harmony trajectory-subsetter
- Weakness
- OS command injection
- Affected boundary
- Authenticated self-service scientific data processing
- Disclosure date
- 2026-09-02
- Public status checked
- 2026-09-10
- Public attribution
- cl45h
What the evidence established
The public report records a bounded confirmation and a subsequent public fix release.
Why the impact was credible
The source reported command execution within the processing environment for a low-friction account holder.
Durable engineering lesson
This is a strong evidence-led case study because the disclosure pairs a narrow proof boundary with a specific defensive pattern: data should be passed as structured arguments, not composed into executable text.
Control pattern
Pass process arguments as a vector, avoid shell evaluation, and keep structured input out of command-string construction.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.