The vulnerability chain in NASA fprime-gds stems from the Flask web application that exposes all endpoints without any authentication. Attackers can read and write files beyond the intended upload directory through a path traversal flaw, and the hardcoded secret key permits forging of session cookies. These weaknesses combine to enable an unauthenticated remote user to execute arbitrary code on the ground station host and dispatch arbitrary commands to any connected spacecraft. The resulting loss of confidentiality, integrity, and availability is critical, as full control of the ground data system is possible.

NASA fprime-gds versions up to and including 3.4.3 are affected. Any deployment of the ground station using these releases is vulnerable, regardless of host environment or network segmentation.

The CVSS score of 9.8 indicates a high‑severity risk, and though an EPSS value is not provided, the lack of authentication combined with exposed network endpoints suggests a high likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, but its mechanism—unauthenticated remote code execution via a web service—makes it a prime target for adversaries. Attackers can launch the exploit from any network location that can reach the Flask service, making it an internet‑facing risk.