High, CVSS 7.6npmAmendedPublished
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
CVE-2026-77394 · GHSA-gvf2-2rh5-mpgf
- Affected
- npm @openc3/vue-common >= 5.0.6, <= 7.2.1
- Fixed in
- 7.3.0· Vendor fix available
- Issue
- A user who can save a telemetry screen (permission systemset) can embed JavaScript in a screen BUTTON widget. The BUTTON widget eval()s the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope. As a result, an attacker's stored JavaScript executes in a different operator's authenticated session — a stored, cross-user XSS (not self-XSS). The payload runs in the COSMOS origin and can read localStorage.openc3Token (the victim's session token), enabling session/account takeover and, via the victim's privileges, a path to server-side code execution through the Script Runner. The site's Content-Security-Policy permits 'unsafe-inline'/'unsafe-eval' (see "Contributing factor"), so the injected script runs unimpeded. - Product: OpenC3 COSMOS (Core; likely Enterprise — see scoping note) - Affected version: confirmed 7.2.0 (latest, tested 2026-06-25); the code path is present on main. Lower bound for…
Recommended action: Upgrade to 7.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.