Unsafe input evaluation in an API validation path
Input parsers should have no ambient ability to execute. Replacing an evaluating reader with a data-only parser is the kind of small implementation change that restores a critical trust boundary.
- Original severity
- P1 source-reported; not rescored by vulns.co
- Public source
- bugcrowd crowdstream
- Program / vendor
- National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
- Product / surface
- CMR API input validation
- Weakness
- Unsafe evaluation of untrusted input · CWE-95
- Affected boundary
- Unauthenticated API parameter validation
- Disclosure date
- 2026-03-20
- Public status checked
- 2026-09-10
- Public attribution
- obaskly
What the evidence established
The source says the public issue was remediated by changing from an evaluating reader to a data-only parser.
Why the impact was credible
The source reported unauthenticated server-side command-execution risk through the affected validation path.
Durable engineering lesson
Input parsers should have no ambient ability to execute. Replacing an evaluating reader with a data-only parser is the kind of small implementation change that restores a critical trust boundary.
Control pattern
Use a non-evaluating data parser, validate against a constrained schema, and separate validation from execution-capable interpreters.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.