NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The chain, tracked as GHSA-p9r8-2q67-fp86 and rated 9.4 on the CVSS v3.1 scoring system, impacts AIT-GUI

The article reports that Cycode researchers discovered a high-severity (CVSS 9.4) chain of flaws in NASA/JPL’s AIT-GUI, the browser-based operator console for the open-source AMMOS Instrument Toolkit, that could let unauthenticated attackers issue arbitrary commands to the spacecraft and instrument command bus. These are concrete vulnerabilities in mission-critical control software rather than in an AI model itself, but they affect an open-source component in a sensitive technical supply chain. From a RealGround perspective, this illustrates how insecure open-source toolchains and consoles around data/telemetry and automated control systems can become a critical AI-adjacent supply chain risk. Organizations using similar toolkits should maintain detailed software bills of materials, continuously test operational consoles for authz/authn flaws, and integrate these components into broader AI and automation red-teaming and supply chain security programs.