Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

cosmos — Vulnerabilities & Security Advisories 12

All 12 CVE vulnerabilities found in cosmos, with AI-generated Chinese analysis, references, and POCs.

Vendor: OpenC3

CVE ID Title CVSS Severity Published
CVE-2026-77602 OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) CWE-94 9.9 Critical 2026-09-23
CVE-2026-77394 OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget CWE-79 7.6 High 2026-09-23
CVE-2026-77601 OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting CWE-78 8.8 High 2026-09-23
CVE-2026-42088 OpenC3 COSMOS: Administrative Actions via the Script Runner Tool CWE-250 9.6 Critical 2026-05-04
CVE-2026-42087 OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base CWE-89 9.6 Critical 2026-05-04
CVE-2026-42086 OpenC3 COSMOS: Self-XSS in the Command Sender CWE-79 4.6 Medium 2026-05-04
CVE-2026-42085 OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames CWE-23 4.3 Medium 2026-05-04
CVE-2026-42084 OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence CWE-620 8.1 High 2026-05-04
CVE-2025-68271 Unauthenticated Remote Code Execution in openc3-api CWE-95 10.0 Critical 2026-01-13
CVE-2024-47529 OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`) CWE-312 5.4 - 2024-10-02
CVE-2024-46977 OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`) CWE-22 6.5 - 2024-10-02
CVE-2024-43795 OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`) CWE-79 6.1 - 2024-10-02

All 12 known CVE vulnerabilities affecting cosmos with full Chinese analysis, references, and POCs where available.