Read the docs
TI-2026-30454 Aliases CVE-2026-42086GHSA-ffq5-qpvf-xq7x

OpenC3 COSMOS: Self-XSS in the Command Sender

Priority MEDIUM 54CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage. This issue has been patched in version 7.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.002 9th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cosmos (OpenC3): 7.0.0openc3 (RubyGems): 7.0.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenC3cosmosbefore 7.0.07.0.0Patch availableCNA
—openc3 (RubyGems)before 7.0.07.0.0Patch availableGHSA-ffq5-qpvf-xq7x
—openc3 (PyPI)before 7.0.07.0.0Patch availableGHSA-ffq5-qpvf-xq7x
  • cosmos VendorOpenC3 Affected before 7.0.0 Fixed in 7.0.0 Patch available CNA
  • openc3 (RubyGems) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-ffq5-qpvf-xq7x
  • openc3 (PyPI) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-ffq5-qpvf-xq7x

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:openc3:cosmos:*:*:*:*:open_source:*:*:*before 7.0.0VulnerableOpenC3
cpe:2.3:a:openc3:cosmos:7.0.0:rc1:*:*:open_source:*:*:*7.0.0 rc1VulnerableOpenC3
cpe:2.3:a:openc3:cosmos:7.0.0:rc2:*:*:open_source:*:*:*7.0.0 rc2VulnerableOpenC3
cpe:2.3:a:openc3:cosmos:7.0.0:rc3:*:*:open_source:*:*:*7.0.0 rc3VulnerableOpenC3
  • cpe:2.3:a:openc3:cosmos:*:*:*:*:open_source:*:*:* Versions before 7.0.0 Vulnerable ·OpenC3
  • cpe:2.3:a:openc3:cosmos:7.0.0:rc1:*:*:open_source:*:*:* Versions 7.0.0 rc1 Vulnerable ·OpenC3
  • cpe:2.3:a:openc3:cosmos:7.0.0:rc2:*:*:open_source:*:*:* Versions 7.0.0 rc2 Vulnerable ·OpenC3
  • cpe:2.3:a:openc3:cosmos:7.0.0:rc3:*:*:open_source:*:*:* Versions 7.0.0 rc3 Vulnerable ·OpenC3

Remediation

  • Fix · CNA cosmos (OpenC3) Fixed in 7.0.0
  • Fix · GHSA-ffq5-qpvf-xq7x openc3 (RubyGems) Fixed in 7.0.0 Advisory →
  • Fix · GHSA-ffq5-qpvf-xq7x openc3 (PyPI) Fixed in 7.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42086
  2. 2026-10-03 Alias added: GHSA-ffq5-qpvf-xq7x

References

Exploit 1

Advisory 1

Other 3

  • TI-2025-20781 Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack. CVSS 3.1CRITICAL 9.8
  • TI-2025-20780 OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account. CVSS 3.1CRITICAL 9.8
  • TI-2025-20779 A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3… CVSS 3.1CRITICAL 9.8
  • TI-2025-20778 An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows… CVSS 3.1CRITICAL 9.1
  • TI-2026-30456 OpenC3 COSMOS: Administrative Actions via the Script Runner Tool CVSS 3.1CRITICAL 9.6
  • TI-2026-30455 OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base CVSS 3.1CRITICAL 9.6
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences