Reflected XSS in NASA JPL Solar System Simulator

Disclosed by

Engagement National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
Disclosed date 7 Jul 2026 3 months ago
Priority P3 Bugcrowd's VRT priority rating
Status Resolved This vulnerability has been accepted and fixed

Summary by cyb3rk1d

A Reflected XSS vulnerability in the JPL Solar System Simulator (/cgi-bin/LHscript.pl) allowed arbitrary JavaScript execution via unsanitized query parameters. Demonstrated impact included a fake NASA login form to harvest credentials, and silent redirection to external sites. NASA resolved the issue by removing the vulnerable endpoint.

Reflected XSS in NASA JPL Solar System Simulator

Summary by cyb3rk1d

Activity