CVE-2025-62193

Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.

• CWE-78

• https://github.com/NOAA-PMEL/LAS/blob/main/README.md
• https://github.com/NOAA-PMEL/LAS/commit/de5f9237bfd4ac5085bcc49a6e30bbc9507ddb29
• https://github.com/NOAA-PMEL/LAS/commit/e69afb1898ae7e69f3e047513fc1e5570373912b
• https://github.com/NOAA-PMEL/LAS/compare/b4b7306..de5f923
• https://github.com/NOAA-PMEL/LAS/tree/main
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-015-01.json
• https://www.cve.org/CVERecord?id=CVE-2025-62193

Published

Jan 15, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62186Ankitects Anki before 25.02.5 allows a crafted shared deck o…7.8
• CVE-2025-62187In Ankitects Anki before 25.02.6, crafted sound file referen…3.3
• CVE-2025-62188An Exposure of Sensitive Information to an Unauthorized Acto…7.5
• CVE-2025-62189LogStare Collector contains an incorrect authorization vulne…5.3
• CVE-2025-62190Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10…4.3
• CVE-2025-62192SQL Injection vulnerability exists in GroupSession Free edit…5.4
• CVE-2025-62198An authenticated user can perform XSS. This issue affects A…5.4
• CVE-2025-62199Use after free in Microsoft Office allows an unauthorized at…7.8
• CVE-2025-6220The Ultra Addons for Contact Form 7 plugin for WordPress is …7.2
• CVE-2025-62200Untrusted pointer dereference in Microsoft Office Excel allo…7.8
• CVE-2025-62201Heap-based buffer overflow in Microsoft Office Excel allows …7.8
• CVE-2025-62202Out-of-bounds read in Microsoft Office Excel allows an unaut…7.1