This vulnerability in NASA HyperCP involves improper neutralization of special elements used in OS commands (CWE-78). Specifically, the Source/OBPGSession.py handler processes server response headers from oceandata.sci.gsfc.nasa.gov without sanitization, allowing an attacker who can intercept or spoof these responses to inject arbitrary commands. When a user initiates a data download, these malicious commands are executed on the local system via subprocess calls, leading to potential full system compromise.

Successful exploitation allows an unauthenticated, network-adjacent attacker to execute arbitrary system commands on the target workstation, resulting in full confidentiality, integrity, and availability compromise (high impact on all CIA triad elements). This could lead to unauthorized data access, system control, or disruption of research activities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, users should avoid performing data download operations against untrusted or tampered servers and ensure network communications with oceandata.sci.gsfc.nasa.gov are protected against interception or spoofing.