CVE-2018-1000047

HIGH

NASA Kodiak v1.0 - Remote Code Execution via Untrusted File Deserialization

Title source: llm

Description

NASA Kodiak version v1.0 contains a CWE-502 vulnerability in Kodiak library's data processing function that can result in remote code execution. This attack appear to be exploitable via Victim opens an untrusted file for optimization using Kodiak library.

References (1)

Core 1

Core References

Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/nasa/Kodiak/issues/5

Scores

CVSS v3 8.8

EPSS 0.0206

EPSS Percentile 78.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-502

Status published

Products (1)

nasa/kodiak 1.0

Published Feb 09, 2018

Tracked Since Feb 18, 2026