Eval Injection

Overview Affected versions of this package are vulnerable to Eval Injection via the converttovalue function. An unauthenticated attacker can execute arbitrary code by sending specially crafted JSON-RPC requests containing malicious parameter text, which is evaluated through eval when processed as...

openc3-api Vulnerable to Unauthenticated Remote Code Execution

Summary OpenC3 COSMOS contains a critical remote code execution vulnerability reachable through the JSON-RPC API. When a JSON-RPC request uses the string form of certain APIs, attacker-controlled parameter text is parsed into values using Stringconverttovalue. For array-like inputs, converttovalu...