GHSA-VP3W-52V9-Q57F OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

Summary An authenticated user can execute arbitrary operating system commands on the openc3-cosmos-cmd-tlm-api service. The pypiurl setting is interpolated, unescaped, into a command line that is run through a shell backtick when a plugin is installed. Shell metacharacters in the setting value ar...

OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

Summary An authenticated user can execute arbitrary operating system commands on the openc3-cosmos-cmd-tlm-api service. The pypiurl setting is interpolated, unescaped, into a command line that is run through a shell backtick when a plugin is installed. Shell metacharacters in the setting value ar...

CVE-2026-77601 OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...

CVE-2026-77601

OpenC3 COSMOS versions 5.12.0 through 7.3.0 are vulnerable to authenticated OS command injection via the pypi_url setting. An attacker can use the set_setting API method (POST /openc3-api/api) to write a malicious URL containing shell metacharacters. When a plugin with Python dependencies is inst...

CVE-2026-77601 OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...

EUVD-2026-85563

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...

CVE-2026-77601 OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...

PT-2026-97524

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.1.0 through 7.3.0 Description Authenticated non-administrator users can achieve arbitrary code execution on a COSMOS server by writing malicious content into the targets modified/ overlay directory. This is possible...

CVE-2026-77394: Improper Neutralization of Input During Web Page Generation

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with systemset permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by...

CVE-2026-77601: Improper Neutralization of Special Elements used in an OS Command

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...

PT-2026-97523

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.12.0 through 7.2.9 Description An authenticated actor can execute arbitrary operating system commands as the openc3 service user. The issue occurs when the set setting method at the POST /openc3-api/api endpoint is use...

CVE-2026-77602: Improper Control of Generation of Code

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targetsmodified/ that is later executed by multiple configuration paths below the intended...

PT-2026-97522

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.0.6 through 7.2.0 Description An authenticated actor with system set permission can perform a stored cross-user cross-site scripting XSS attack. By sending a request to the 'POST /openc3-api/screen' endpoint, an attack...

EUVD-2026-82591

Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...

CVE-2026-87701

Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...

CVE-2026-87701

Azure Cosmos DB is affected by an injection vulnerability (improper neutralization of special elements in output used by a downstream component) that allows an authorized attacker to elevate privileges over a network . The CVSS 3.1 score is 9.6 (CRITICAL) , with a vector of AV:N/AC:L/PR:L/UI:N/S:...

Azure Cosmos DB Elevation of Privilege Vulnerability

Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...

PT-2026-95177

Name of the Vulnerable Software and Affected Versions Azure Cosmos DB affected versions not specified Description An issue involving improper neutralization of special elements in output used by a downstream component, known as injection, allows an authorized attacker to elevate privileges over a...

CVE-2026-87701: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...

CVE-2026-49446

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...