Summary by infernosalex
An unauthenticated NASA Hydrology Copilot endpoint routed attacker-controlled input to an execute_custom_code tool, resulting in Python execution in the backend application context. Execution was demonstrated with fresh nonce digests and harmless hostname and working-directory checks; testing stopped after sufficient proof without modifying files, establishing persistence, or moving laterally.
Bugcrowd validated the submission as P1 Remote Code Execution, NASA fixed the vulnerability, and NASA issued a Letter of Recognition. I appreciate the coordinated handling by both teams.