CVE-2026-72579

Name of the Vulnerable Software and Affected Versions NASA HyperCP (main branch)

Description An OS command injection issue exists where a network-adjacent attacker can execute arbitrary system commands on a researcher's workstation by intercepting or spoofing responses from the 'oceandata.sci.gsfc.nasa.gov' server. The Source/OBPGSession.py handler fails to sanitize server response headers and passes attacker-controlled field values to subprocess calls during data download operations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.