Openc3 Cosmos vulnerabilities

• openc3 cosmos OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) CVE-2026-77602 Fix available 9.9 CriticalSeptember 23, 2026
• openc3 cosmos OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget CVE-2026-77394 Fix available 7.6 HighSeptember 23, 2026
• openc3 cosmos OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting CVE-2026-77601 Fix available 8.8 HighSeptember 23, 2026
• openc3 cosmos OpenC3 COSMOS: Administrative Actions via the Script Runner Tool CVE-2026-42088 Fix available 9.6 CriticalApril 23, 2026
• openc3 cosmos OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base CVE-2026-42087 Fix available 9.6 CriticalApril 23, 2026
• openc3 cosmos OpenC3 COSMOS: Self-XSS in the Command Sender CVE-2026-42086 Fix available 4.6 MediumApril 22, 2026
• openc3 cosmos OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames CVE-2026-42085 Fix available 4.3 MediumApril 22, 2026
• openc3 cosmos OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence CVE-2026-42084 Fix available 8.1 HighApril 22, 2026
• openc3 cosmos Unauthenticated Remote Code Execution in openc3-api CVE-2025-68271 Fix available 10.0 CriticalJanuary 13, 2026
• openc3 cosmos Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a... CVE-2025-28389 9.8 CriticalJune 13, 2025
• openc3 cosmos OpenC3 COSMOS v6.0.0 was discovered to contain hardcoded credentials for the Service Account. CVE-2025-28388 9.8 CriticalJune 13, 2025
• openc3 cosmos A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS... CVE-2025-28386 9.8 CriticalJune 13, 2025
• openc3 cosmos OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint CVE-2025-28384 9.1 CriticalJune 13, 2025
• openc3 cosmos OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint CVE-2025-28382 7.5 HighJune 13, 2025
• openc3 cosmos A credential leak in OpenC3 COSMOS v6.0.0 allows attackers to access service credentials as... CVE-2025-28381 7.5 HighJune 13, 2025
• openc3 cosmos A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS v6.0.0 allows attackers to execute... CVE-2025-28380 6.1 MediumJune 13, 2025
• openc3 cosmos OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`) CVE-2024-47529 Fix available 4.8 MediumOctober 2, 2024
• openc3 cosmos OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`) CVE-2024-46977 Fix available 5.3 MediumOctober 2, 2024
• openc3 cosmos OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`) CVE-2024-43795 Fix available 5.1 MediumOctober 2, 2024