CVE-2025-62193

Critical

Description

Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.

SeverityCritical

CVSS9.8

Exploit probability—

ProductLive Access Server (LAS)

PublishedJan 15, 2026

First seenJan 15, 2026

Weakness typeCWE-78OS command injection

How to fix

Patches

github.com/NOAA-PMEL/LAS/blob/main/README.md
github.com/NOAA-PMEL/LAS/commit/de5f9237bfd4ac5085bcc49a6e30bbc9507ddb29
github.com/NOAA-PMEL/LAS/commit/e69afb1898ae7e69f3e047513fc1e5570373912b
github.com/NOAA-PMEL/LAS/compare/b4b7306..de5f923

Affected products

Product	Affected versions	Fixed in
National Oceanic and Atmospheric Administration (NOAA) Live Access Server (LAS)	8	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.