NASA AIT-GUI Critical Vulnerability: Unauthenticated Spacecraft Commands

**Executive summary:** The report details a critical vulnerability in NASA/JPL's AIT-GUI (CVE-2026-60112) that can allow unauthenticated remote actors to invoke command and script execution, potentially affecting spacecraft and scientific instruments; the issue involves missing authentication/authorization, lack of CSRF protection, path traversal risks, and possible exposure when bound to 0.0.0.0:8080, and was addressed in AIT-GUI version 2.5.2 with recommended mitigation steps including patching, access restrictions, and log review.