Vulnerability · Published Sep 23, 2025 · Assigned by GitHub_M

CVE-2025-59534CryptoLib command Injection vulnerability in initialize_kerberos_keytab_file_login()

High 7.3

In plain English

A high-severity OS command injection in CryptoLib from nasa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.9%top 39.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.2, there is a command Injection vulnerability in initialize_kerberos_keytab_file_login(). The vulnerability exists because the code directly interpolates user-controlled input into a shell command and executes it via system() without any sanitization or validation. This issue has been patched in version 1.4.2.

Affected products (as reported)

Vendor	Product	Versions
nasa	CryptoLib	< 1.4.2

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/nasa/CryptoLib/security/advisories/GHSA-jw5c-58hr-m3v3 x_refsource_CONFIRM
https://github.com/nasa/CryptoLib/commit/3ccb1b306026bb20a028fbfdcf18935f7345ed2f x_refsource_MISC