CVE-2026-5473
MediumCVSS 4.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
NASA cFS up to version 7.0.0 has a vulnerability in the function pickle.load in the Pickle Module component that leads to deserialization. The attack requires local access and is considered difficult to exploit. The project was informed but has not responded.
Risk Assessment
Deserialization could allow an attacker to execute arbitrary code or manipulate data, but due to high complexity and required local access, the risk is limited.
Recommendation
Monitor vendor updates and apply patches when available. Restrict local access to the system.
Original NVD description (English source)
A vulnerability has been found in NASA cFS up to 7.0.0. The impacted element is the function pickle.load of the component Pickle Module. Such manipulation leads to deserialization. The attack needs to be performed locally. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.