Deserialization Vulnerability in NASA cFS Software

CVE-2026-5473

What is CVE-2026-5473?

A vulnerability exists in the NASA cFS software, specifically affecting the pickle.load function within the Pickle Module. This security flaw enables local deserialization attacks, which could potentially lead to unauthorized code execution. The complexity of successfully exploiting this vulnerability is considered high, and the attack methodology requires local access. Although the issue was communicated to the project team early through an issue report, there has yet to be a response or resolution from NASA regarding this critical concern.

References