CVE-2026-77394 Details
Description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0.
A stored cross-site scripting vulnerability has been identified in OpenC3 COSMOS versions 5.0.6 prior to 7.3.0. The issue allows an authenticated user with 'system_set' permission to inject JavaScript into a 'BUTTON' widget on a telemetry screen. When the button is clicked, the injected script is executed in the context of another user's session, leading to the theft of the victim's session token and potential account takeover. The vulnerability arises because the application evaluates the button's action using 'eval()', and the Content Security Policy (CSP) is too permissive, allowing the execution of unsafe scripts.
Users can upgrade to OpenC3 COSMOS version 7.3.0, where this vulnerability has been fixed. In addition, the Content Security Policy should be tightened to remove 'unsafe-inline' and 'unsafe-eval', and screens should be treated as untrusted content.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3 | [email protected] | Source CodeVendor |
| https://github.com/OpenC3/cosmos/pull/3560 | [email protected] | Issue TrackingVendor |
| https://github.com/OpenC3/cosmos/releases/tag/v7.3.0 | [email protected] | Release NotesVendor |
| https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenC3 COSMOS | >= 5.0.6, <= 7.2.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |