openc3/cosmos Security Advisories | GitStock

high2026-09-23

OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

GHSA-gvf2-2rh5-mpgf · CVE-2026-77394

critical2026-09-23

OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

GHSA-jjq7-m736-w977 · CVE-2026-77602

high2026-09-23

OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

GHSA-vp3w-52v9-q57f · CVE-2026-77601

critical2026-04-23

OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool

GHSA-2wvh-87g2-89hr

critical2026-04-23

OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database

GHSA-v529-vhwc-wfc5 · CVE-2026-42087

medium2026-04-22

OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender

GHSA-ffq5-qpvf-xq7x · CVE-2026-42086

medium2026-04-22

OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed config filenames

GHSA-4jvx-93h3-f45h · CVE-2026-42085

high2026-04-22

OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

GHSA-wgx6-g857-jjf7 · CVE-2026-42084

critical2026-01-13

openc3-api Vulnerable to Unauthenticated Remote Code Execution

GHSA-w757-4qv9-mghp · CVE-2025-68271

critical2025-06-13

OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint

GHSA-p67j-387g-75wc · CVE-2025-28384

high2025-06-13

OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint

GHSA-cf8v-5mrc-jv7f · CVE-2025-28382

medium2024-10-02

OpenC3 stores passwords in clear text (`GHSL-2024-129`)

GHSA-4xqv-47rm-37mm · CVE-2024-47529

high2024-10-02

OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)

GHSA-8jxr-mccc-mwg8 · CVE-2024-46977

medium2024-10-02

OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)

GHSA-vfj8-5pj7-2f9g · CVE-2024-43795