Is CVE-2026-47731 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47731 being exploited in the wild.

How severe is CVE-2026-47731?

Critical severity, with a CVSS score of 9.1, published 21 July 2026.

Which products and versions are affected?

Nasa AMMOS Instrument Toolkit Core = 3.1.0, < 3.1.1; ait-core (PyPI) ECOSYSTEM:introduced=0,fixed=2.6.1,introduced=3.1.0,fixed=3.1.1, ECOSYSTEM:introduced=3.1.0,fixed=3.1.1.

Is there a fix for CVE-2026-47731?

Yes. ait-core (PyPI): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47731 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47731?

Check whether you run Nasa AMMOS Instrument Toolkit Core or ait-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47731: NASA AMMOS AIT-Core path traversal in Binary Stream Capture

Q: Is there a fix for CVE-2026-47731?

Yes. ait-core (PyPI): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47731 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-47731?

Check whether you run Nasa AMMOS Instrument Toolkit Core or ait-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47731 · Severity: critical · CVSS 9.1 · Published 2026-07-21

NASA's AMMOS Instrument Toolkit (AIT-Core), a software suite used for managing satellite and CubeSat missions, contains a vulnerability in its data capture component. An unauthenticated attacker can remotely bypass security restrictions to write or append data to any file on the host system. This could lead to system crashes, data corruption, or potentially full system takeover if the attacker modifies critical scripts or executable files.

Technologies: ait-core (PyPI). Vendors: Nasa, PyPI.

Quick answers

Is CVE-2026-47731 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47731 being exploited in the wild.
How severe is CVE-2026-47731?: Critical severity, with a CVSS score of 9.1, published 21 July 2026.
Which products and versions are affected?: Nasa AMMOS Instrument Toolkit Core < 2.6.1, >= 3.1.0, < 3.1.1; ait-core (PyPI) ECOSYSTEM:introduced=0,fixed=2.6.1,introduced=3.1.0,fixed=3.1.1, ECOSYSTEM:introduced=3.1.0,fixed=3.1.1.
Is there a fix for CVE-2026-47731?: Yes. ait-core (PyPI): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47731 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47731?: Check whether you run Nasa AMMOS Instrument Toolkit Core or ait-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ait-core (PyPI): upgrade to 3.1.1 or later
```
pip install "ait-core>=3.1.1"
```

Technical details

A path traversal vulnerability exists in the Binary Stream Capture (BSC) component of AIT-Core due to insufficient validation of path-related fields in the `StreamCaptureManagerServer` unauthenticated HTTP API. The `_add_logger_by_name` handler blindly trusts form fields such as `log_dir_path` and `path`, passing them to `os.path.join()`. An attacker can provide absolute paths or traversal sequences to escape the configured log directory. By directing the BSC process to log to sensitive files (e.g., Python scripts or system configurations), an attacker can append arbitrary data, leading to data corruption or Remote Code Execution (RCE). The vulnerability can be exploited directly via network requests or indirectly via Cross-Site Request Forgery (CSRF) if a user in the local network visits a malicious website. Fixed in versions 2.6.1 and 3.1.1.

Affected products

NASA-AMMOS AIT-Core 2.x before 2.6.1, 3.1.0

Identifiers

CVE-2026-47731
GHSA-p462-prxw-mjx4
PYSEC-2026-265

Timeline

2026-05-19: patched: Versions 2.6.1 and 3.1.1 released
2026-07-21: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.