CVE-2026-53984

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53984
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53984.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53984
Aliases
Published
2026-08-06T15:33:49.861Z
Modified
2026-08-07T11:56:10.889291381Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Ground Station prior to 0.6.0 Unauthenticated Database Wipe and Arbitrary Data Injection via Socket.IO database_backup full_restore Action
Details

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullrestore command with a caller-supplied SQL blob. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the databasebackup event to drop every existing table and recreate the database from attacker-controlled CREATE TABLE and INSERT INTO statements executed via raw execdriver_sql, permanently destroying all satellite records, orbital sources, hardware configurations, and observation schedules, or planting fabricated orbital-source URLs and observation entries that redirect the ground station to attacker-controlled servers on the next scheduled sync.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53984.json",
    "cwe_ids": [
        "CWE-306"
    ]
}
References

Affected packages

Git / github.com/sgoudelis/ground-station

Affected ranges

Type
GIT
Repo
https://github.com/sgoudelis/ground-station
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2ecde82a8814cbea18883ce023bf45cbf06172eb
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.6.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.1.7
Other
push
v0.*
v0.1.10
v0.1.11
v0.1.12
v0.1.13
v0.1.14
v0.1.15
v0.1.16
v0.1.17
v0.1.18
v0.1.19
v0.1.20
v0.1.21
v0.1.22
v0.1.23
v0.1.24
v0.1.25
v0.1.26
v0.1.27
v0.1.28
v0.1.29
v0.1.3
v0.1.30
v0.1.31
v0.1.32
v0.1.33
v0.1.34
v0.1.35
v0.1.36
v0.1.37
v0.1.38
v0.1.39
v0.1.4
v0.1.40
v0.1.41
v0.1.42
v0.1.43
v0.1.44
v0.1.45
v0.1.46
v0.1.47
v0.1.48
v0.1.49
v0.1.5
v0.1.5-test1
v0.1.5-test2
v0.1.5-test3
v0.1.5-test4
v0.1.5-test5
v0.1.5-test6
v0.1.50
v0.1.51
v0.1.52
v0.1.53
v0.1.54
v0.1.55
v0.1.56
v0.1.57
v0.1.58
v0.1.59
v0.1.6
v0.1.60
v0.1.61
v0.1.62
v0.1.63
v0.1.64
v0.1.65
v0.1.66
v0.1.67
v0.1.68
v0.1.69
v0.1.7
v0.1.70
v0.1.71
v0.1.72
v0.1.73
v0.1.74
v0.1.75
v0.1.76
v0.1.77
v0.1.78
v0.1.79
v0.1.8
v0.1.80
v0.1.81
v0.1.82
v0.1.83
v0.1.84
v0.1.85
v0.1.9
v0.2.0
v0.2.1
v0.2.10
v0.2.11
v0.2.13
v0.2.14
v0.2.15
v0.2.16
v0.2.17
v0.2.18
v0.2.19
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8
v0.2.9
v0.3.0
v0.3.1
v0.3.10
v0.3.11
v0.3.12
v0.3.13
v0.3.14
v0.3.15
v0.3.16
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.3.9
v0.4.0
v0.4.1
v0.4.10
v0.4.11
v0.4.12
v0.4.13
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v0.5.0
v0.5.1
v0.5.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53984.json"