CVE-2026-77602 Details
Description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later executed by multiple configuration paths below the intended code-execution privilege tier. Table and command or telemetry definitions are processed through ConfigParser, PacketConfig, GENERIC_READ_CONVERSION, or GENERIC_WRITE_CONVERSION, allowing ERB rendering or Ruby and Python evaluation, while openc3-cosmos-script-runner-api/scripts/run_suite_analysis.rb executes suite procedure files through require. Storage uploads, screen saves, and script creation can place content in the overlay, and triggering table processing, a cmd/tlm reload, or suite analysis executes the content in cmd-tlm-api, decom microservices, or Script Runner with access to internal credentials and data. This issue is fixed in version 7.3.0.
A vulnerability in OpenC3 COSMOS versions 5.1.0 through 7.2.1 allows authenticated non-administrator users to execute arbitrary code on the server. This issue arises from the application's handling of configuration files in a user-writable overlay, 'targets_modified/', which is read before the default, read-only configuration. The vulnerability is exploited by writing malicious payloads into the overlay, which are then executed as code through various application features. The executed code runs with the same privileges as the 'openc3' user, accessing sensitive internal data and credentials.
Users can update to OpenC3 COSMOS version 7.3.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OpenC3/cosmos/commit/71943352a28128ef3e7e894319d97a656b5cd4f2 | [email protected] | Source CodeVendor |
| https://github.com/OpenC3/cosmos/commit/7a1538a4626f82c0d1540fcaa27ffdcbbd71ff81 | [email protected] | Source CodeVendor |
| https://github.com/OpenC3/cosmos/pull/3488 | [email protected] | Issue TrackingVendor |
| https://github.com/OpenC3/cosmos/security/advisories/GHSA-jjq7-m736-w977 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenC3 COSMOS | >= 5.1.0, <= 7.2.1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | New CVE Received | [email protected] |