Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

openc3

15 known vulnerabilities (6 critical, 3 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
15 · 6 critical, 3 high, 6 medium
Weekly downloads
3,118
Dependents
0
Registry
PyPI

Advisories 15

  • CVE-2026-42088Critical 9.6

    OpenC3 COSMOS: Administrative Actions via the Script Runner Tool

    Affected: fixed in 7.0.0.

  • CVE-2026-42087Critical 9.6

    OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base

    Affected: from 6.7.0, fixed in 7.0.0.

  • CVE-2026-42086Medium 4.6

    OpenC3 COSMOS: Self-XSS in the Command Sender

    Affected: fixed in 7.0.0.

  • CVE-2026-42085Medium 4.3

    OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames

    Affected: fixed in 6.10.5.

  • OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

    Affected: fixed in 6.10.5.

  • CVE-2025-28389Critical 9.8

    Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.

    Affected: through 6.0.0.

  • CVE-2025-28388Critical 9.8

    OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.

    Affected: through 6.0.0.

  • CVE-2025-28386Critical 9.8

    A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute…

    Affected: through 6.0.0.

  • CVE-2025-28384Critical 9.1

    An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

    Affected: through 6.0.0.

  • An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

    Affected: through 6.0.0.

  • A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all…

    Affected: through 6.0.0.

  • CVE-2025-28380Medium 6.1

    A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via…

    Affected: through 6.0.0.

  • CVE-2024-47529Medium 4.8

    OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)

    Affected: fixed in 5.19.0.

  • CVE-2024-46977Medium 5.3

    OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)

    Affected: fixed in 5.19.0.

  • CVE-2024-43795Medium 5.1

    OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`)

    Affected: fixed in 5.19.0.