Skip to content
OpenAdvisories

Vendor

OpenC3

12 known vulnerabilities.

Products

cosmos 12
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.6
    CVE-2026-77394

    OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

    OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose B…

    OpenC3 cosmos @openc3/vue-common npm
  • High 8.8
    CVE-2026-77601

    OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

    OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause Open…

    OpenC3 cosmos openc3 RubyGems
  • High 8.1
    CVE-2026-42084

    OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

    OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing t…

    OpenC3 cosmos openc3 openc3 PyPI RubyGems