Description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a reflected cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 5.19.0. Note: This CVE only affects Open Source Edition, and not OpenC3 COSMOS Enterprise Edition.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenC3 | cosmos | < 5.19.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @openc3/tool-common | < 5.19.0 | 5.19.0 | GHSA-vfj8-5pj7-2f9g |
| PyPI | openc3 | < 5.19.0 | 5.19.0 | PYSEC-2024-100 |
| RubyGems | openc3 | < 5.19.0 | 5.19.0 | GHSA-vfj8-5pj7-2f9g |