A critical vulnerability in NASA's open-source AMMOS Instrument Toolkit (AIT)-GUI ground software has been found that could allow unauthenticated attackers to issue spacecraft and instrument commands, execute server-side scripts and run command sequences. AIT-GUI is the browser-based operator console for NASA's AMMOS Instrument Toolkit, an open-source framework for ground data systems that communicate with instruments and spacecraft. The flaw, tracked as GHSA-p9r8-2q67-fp86 and given a CVSS ratting of 9.4, affects AIT-GUI versions through 2.5.1. No CVE has been assigned at the time of writing. Cycode researcher Yuval Elbar disclosed the findings on August 18 and the flaw has been fixed in AIT-GUI 2.5.2. Unauthenticated API Exposes Command Functions AIT-GUI starts its web server on all…