CVE-2024-46977

OpenC3 COSMOS contains a path traversal vulnerability in LocalMode.open_local_file that, when exploited by an authenticated user with adequate permissions, can download any .txt via ScreensController#show on the COSMOS web server. The issue may lead to information disclosure and is fixed in versi...

CVE-2025-28386

The OpenC3 COSMOS v6.0.0 application is vulnerable to Remote Code Execution (RCE) via its Plugin Management component. The root cause is an Arbitrary Code Injection flaw in the plugin_model.rb script, where an attacker can upload a crafted requirements.txt file containing a malicious plugin to ex...

CVE-2025-28389

The OpenC3 COSMOS v6.0.0 application is vulnerable to authentication bypass due to weak password requirements . The software supports clear-text passwords, which enables an attacker to gain unauthorized access via a brute force attack . As a mitigation, users are advised to use authentication tok...

CVE-2025-28384

The OpenC3 COSMOS framework (specifically the openc3-cosmos-tool-iframe component) is vulnerable to a Directory Traversal (CWE-22) issue in the /script-api/scripts/ endpoint. The root cause is improper input validation and insufficient sanitization of path parameters, which allows an authenticate...

CVE-2025-28382

The OpenC3 COSMOS framework is vulnerable to a Directory Traversal (CWE-22) issue in the openc3-api/tables endpoint, affecting versions before 6.1.0 . The root cause is improper input validation and insufficient sanitization of user-supplied input, which allows an attacker to traverse directories...

CVE-2024-47529

Summary: OpenC3 COSMOS stores a user password in unencrypted form in the browser’s LocalStorage, creating a risk of password exfiltration via cross-site scripting (XSS). The issue is documented as affecting the Open Source edition and is fixed in version 5.19.0 (Open Source edition). What’s affec...

CVE-2025-28380

A cross-site scripting (XSS) vulnerability exists in OpenC3 COSMOS before v6.0.2 , including version v6.0.0 . The flaw originates from the improper neutralization of input, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the URL parameter . As a res...

CVE-2024-43795

CVE-2024-43795 affects OpenC3 COSMOS Open Source Edition, with a reflected XSS vulnerability in the login functionality. Root cause: improper input handling in the login path allows script injection. Impact is limited to the Open Source Edition per the advisories; Enterprise Edition is not affect...

CVE-2025-28388

Versions of OpenC3 COSMOS prior to v6.0.2 are vulnerable to the use of hard-coded credentials for the Service Account. An attacker could leverage these leaked credentials to use the Service Account as a backdoor to the system. Remediation is available by upgrading the openc3 package to version 6....

CVE-2025-28381

The open-source mission framework OpenC3 COSMOS (versions prior to v6.0.2 , specifically identified in v6.0.0 ) is vulnerable to a credential leak due to the cleartext storage of sensitive information in environment variables. This flaw allows an attacker to access service credentials, which are ...

CVE-2026-42084

OpenC3 COSMOS is affected by a credential change vulnerability where the password change feature accepts a valid session token in lieu of the old password. This flaw, present prior to versions 6.10.5 and 7.0.0-rc3, allows an attacker who already holds a valid session token to change the password ...

CVE-2026-42085

OpenC3 COSMOS has a path-traversal weakness in save_tool_config() that enables arbitrary file writes into the shared /plugins directory prior to versions 6.10.5 and 7.0.0-rc3. By canonicalizing filenames to absolute paths, a crafted config filename can overwrite existing configuration files acros...

CVE-2026-42087

OpenC3 COSMOS TSDB is affected by a SQL injection in the tsdb_lookup function of cvt_model.rb, where user-supplied input is directly placed into a SQL query. Affected versions are 6.7.0 through 7.0.0-rc2 (before the patched 7.0.0-rc3). This allows an attacker to break out of the initial SQL state...

CVE-2026-42088

Summary: CVE-2026-42088 affects OpenC3 COSMOS before 7.0.0-rc3. The Script Runner widget in the openc3-COSMOS-script-runner-api container allows any user with script permissions to bypass API checks and perform administrative actions across the docker network. This can enable reading/modifying da...

CVE-2026-42086

OpenC3 COSMOS is affected by a Self-XSS in the Command Sender UI prior to version 7.0.0, caused by an unsafe eval() on array-like command parameters. A user-supplied payload could execute in the victim’s browser when sending a command, potentially allowing an attacker to read or modify data in th...