Read the docs
TI-2026-54090 Aliases CVE-2026-77602GHSA-jjq7-m736-w977

Code injection in OpenC3 cosmos

Priority HIGH 76CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later executed by multiple configuration paths below the intended code-execution privilege tier. Table and command or telemetry definitions are processed through ConfigParser, PacketConfig, GENERIC_READ_CONVERSION, or GENERIC_WRITE_CONVERSION, allowing ERB rendering or Ruby and Python evaluation, while openc3-cosmos-script-runner-api/scripts/run_suite_analysis.rb executes suite procedure files through require. Storage uploads, screen saves, and script creation can place content in the overlay, and triggering table processing, a cmd/tlm reload, or suite analysis executes the content in cmd-tlm-api, decom microservices, or Script Runner with access to internal credentials and data. This issue is fixed in version 7.3.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00716 54th percentileScored 2026-11-07
Fix Fixed cosmos (OpenC3): 7.3.0openc3 (RubyGems): 7.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenC3cosmos5.1.0 to before 7.3.07.3.0Patch availableCNA
—openc3 (RubyGems)5.1.0 to before 7.3.07.3.0Patch availableGHSA-jjq7-m736-w977
  • cosmos VendorOpenC3 Affected 5.1.0 to before 7.3.0 Fixed in 7.3.0 Patch available CNA
  • openc3 (RubyGems) Vendor— Affected 5.1.0 to before 7.3.0 Fixed in 7.3.0 Patch available GHSA-jjq7-m736-w977

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:openc3:cosmos:*:*:*:*:*:*:*:*——OpenC3
  • cpe:2.3:a:openc3:cosmos:*:*:*:*:*:*:*:* Versions — — ·OpenC3

Remediation

  • Fix · CNA cosmos (OpenC3) Fixed in 7.3.0
  • Fix · GHSA-jjq7-m736-w977 openc3 (RubyGems) Fixed in 7.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77602
  2. 2026-10-03 Alias added: GHSA-jjq7-m736-w977
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Other 5

  • TI-2025-20781 Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack. CVSS 3.1CRITICAL 9.8
  • TI-2025-20780 OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account. CVSS 3.1CRITICAL 9.8
  • TI-2025-20779 A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3… CVSS 3.1CRITICAL 9.8
  • TI-2025-20778 An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows… CVSS 3.1CRITICAL 9.1
  • TI-2026-30456 OpenC3 COSMOS: Administrative Actions via the Script Runner Tool CVSS 3.1CRITICAL 9.6
  • TI-2026-30455 OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base CVSS 3.1CRITICAL 9.6
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences