CVE-2026-77394

OpenC3 COSMOS versions 5.0.6 through 7.3.0 are vulnerable to a stored, cross-user XSS via the Telemetry screen BUTTON widget. An authenticated actor with system_set permissions can store a screen via POST /openc3-api/screen containing a button action. The application fails to sanitize this input,...