OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

4.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS

• CVE-2026-42086: 0.20% estimated exploitation activity in the next 30 days; percentile 9.86 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary The Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage. Details The unsafe eval() usage on user-supplied ARRAY parameters happens in convertToValue method in CommandSender.vue PoC 1. Using a drop-down form, choose any command that supports ARRAY parameters, 2. Inside square brackets “[…]” place a JavaScript code to be executed 3. Send command to CmdTlmServer using dedicated “Send” button 4. Observe JavaScript code being executed in the current browser session context Below example uses INST ARYCMD to execute simple JavaScript code snippet…

Published by the source

22 Apr 2026, 22:22 UTC

Last modified by the source

29 May 2026, 22:00 UTC

Source last checked

26 Oct 2026, 13:41 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-ffq5-qpvf-xq7x

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-ffq5-qpvf-xq7x

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-42086

Advisory: OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender
IDs: CVE-2026-42086, GHSA-ffq5-qpvf-xq7x
Record: https://patchnext.com/advisories/cve-2026-42086 (revision 2, source checked 26 Oct 2026, 13:41 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 4.6)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: openc3 7.0.0; openc3 7.0.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI openc3: affected < 7.0.0; fixed in 7.0.0
- RubyGems openc3: affected < 7.0.0; fixed in 7.0.0

## Suggested inspection (read-only)
- `python -m pip show openc3`: prints the installed version. Run with the environment that serves production active.
- RubyGems openc3: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on openc3.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-ffq5-qpvf-xq7x (OSV record GHSA-ffq5-qpvf-xq7x lists affected ranges: RubyGems openc3 >=0 =0 <7.0.0 (fixed))
- Verified: https://github.com/advisories/GHSA-ffq5-qpvf-xq7x (GitHub-reviewed advisory GHSA-ffq5-qpvf-xq7x lists affected ranges: RubyGems openc3 >=0 =0 <7.0.0)

Commands are suggestions: review each one before running it.