Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

OpenC3 — Vulnerabilities & Security Advisories 12

Browse all 12 CVE security advisories affecting OpenC3. AI-powered Chinese analysis, POCs, and references for each vulnerability.

OpenC3 is a space mission operations framework used for satellite command and control. Historically, it has been vulnerable to multiple remote code execution flaws, cross-site scripting, and privilege escalation vulnerabilities. The software's web interface has been particularly susceptible to authentication bypass and insecure deserialization issues. While no major public security incidents have been widely reported, the nine documented CVEs highlight consistent security concerns in its attack surface, particularly around API endpoints and user authentication mechanisms. The framework's complex architecture and extensive permissions model create multiple potential vectors for unauthorized access if not properly configured and maintained.

Found 12 results / 12 Clear Filters
Top products by OpenC3: cosmos
CVE ID Title CVSS Severity Published
CVE-2026-77602 OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) — cosmos CWE-94 9.9 Critical 2026-09-23
CVE-2026-77394 OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget — cosmos CWE-79 7.6 High 2026-09-23
CVE-2026-77601 OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting — cosmos CWE-78 8.8 High 2026-09-23
CVE-2026-42088 OpenC3 COSMOS: Administrative Actions via the Script Runner Tool — cosmos CWE-250 9.6 Critical 2026-05-04
CVE-2026-42087 OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base — cosmos CWE-89 9.6 Critical 2026-05-04
CVE-2026-42086 OpenC3 COSMOS: Self-XSS in the Command Sender — cosmos CWE-79 4.6 Medium 2026-05-04
CVE-2026-42085 OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames — cosmos CWE-23 4.3 Medium 2026-05-04
CVE-2026-42084 OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence — cosmos CWE-620 8.1 High 2026-05-04
CVE-2025-68271 Unauthenticated Remote Code Execution in openc3-api — cosmos CWE-95 10.0 Critical 2026-01-13
CVE-2024-47529 OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`) — cosmos CWE-312 5.4 - 2024-10-02
CVE-2024-46977 OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`) — cosmos CWE-22 6.5 - 2024-10-02
CVE-2024-43795 OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`) — cosmos CWE-79 6.1 - 2024-10-02

This page lists every published CVE security advisory associated with OpenC3. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.