Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

OpenC3 COSMOS lets logged‑in users run code remotely

CVE-2026-77602 · published 18 days ago
Summary

In OpenC3 COSMOS versions 5.1.0 through 7.3.0, a regular authenticated user could add files to a writable configuration area that the system later executes as code. This lets the user run their own programs, potentially accessing internal credentials and data. Updating to version 7.3.0 or later removes the risk.

What to do
  • Update ryan melton openc3 to version 7.3.0.
  • Update openc3 to version 7.3.0.
Affected software
Ecosystem VendorProductAffected versions
– openc3 cosmos >= 5.1.0, < 7.3.0
rubygems ryan melton openc3 >= 5.1.0, <= 7.2.1
Fix: upgrade to 7.3.0
rubygems – openc3 >= 5.1.0, <= 7.2.1
Fix: upgrade to 7.3.0
RubyGems – openc3 >= 5.1.0, < 7.3.0
Fix: upgrade to 7.3.0
Original advisory text
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later executed by multiple configuration paths below the intended code-execution privilege tier. Table and command or telemetry definitions are processed through ConfigParser, PacketConfig, GENERIC_READ_CONVERSION, or GENERIC_WRITE_CONVERSION, allowing ERB rendering or Ruby and Python evaluation, while openc3-cosmos-script-runner-api/scripts/run_suite_analysis.rb executes suite procedure files through require. Storage uploads, screen saves, and script creation can place content in the overlay, and triggering table processing, a cmd/tlm reload, or suite analysis executes the content in cmd-tlm-api, decom microservices, or Script Runner with access to internal credentials and data. This issue is fixed in version 7.3.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published23 Sep 2026
Updated11 Oct 2026
First seen23 Sep 2026
Sources
CVE-2026-77602 · NVD
CVE-2026-77602 · MITRE
GHSA-jjq7-m736-w977 · GHSA
CVE-2026-77602 · OSV
GHSA-jjq7-m736-w977 · OSV
Track software like this
Free during beta