NASA AIT-Core version 2.5.2 and earlier contains a vulnerability in its API wait function that allows remote attackers to execute arbitrary code by supplying a specially crafted string. This vulnerability has a high severity rating with a CVSS score of 7.5. No public exploits or patches are currently documented.