# openc3 (PyPI) vulnerabilities

15 known vulnerabilities (6 critical, 3 high, 6 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Weekly downloads: 3,118
- Dependents: 0
- Registry: https://pypi.org/project/openc3/

## Advisories (15)

### [CVE-2026-42088](https://cve.now/CVE-2026-42088): OpenC3 COSMOS: Administrative Actions via the Script Runner Tool

- Severity: Critical 9.6
- Published: May 4, 2026
- Affected: fixed in 7.0.0.

### [CVE-2026-42087](https://cve.now/CVE-2026-42087): OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base

- Severity: Critical 9.6
- Published: May 4, 2026
- Affected: from 6.7.0, fixed in 7.0.0.

### [CVE-2026-42086](https://cve.now/CVE-2026-42086): OpenC3 COSMOS: Self-XSS in the Command Sender

- Severity: Medium 4.6
- Published: May 4, 2026
- Affected: fixed in 7.0.0.

### [CVE-2026-42085](https://cve.now/CVE-2026-42085): OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames

- Severity: Medium 4.3
- Published: May 4, 2026
- Affected: fixed in 6.10.5.

### [CVE-2026-42084](https://cve.now/CVE-2026-42084): OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

- Severity: High 8.1
- Published: May 4, 2026
- Affected: fixed in 6.10.5.

### [CVE-2025-28389](https://cve.now/CVE-2025-28389): Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.

- Severity: Critical 9.8
- Published: Jun 13, 2025
- Affected: through 6.0.0.

### [CVE-2025-28388](https://cve.now/CVE-2025-28388): OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.

- Severity: Critical 9.8
- Published: Jun 13, 2025
- Affected: through 6.0.0.

### [CVE-2025-28386](https://cve.now/CVE-2025-28386): A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute…

- Severity: Critical 9.8
- Published: Jun 13, 2025
- Affected: through 6.0.0.

### [CVE-2025-28384](https://cve.now/CVE-2025-28384): An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

- Severity: Critical 9.1
- Published: Jun 13, 2025
- Affected: through 6.0.0.

### [CVE-2025-28382](https://cve.now/CVE-2025-28382): An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

- Severity: High 7.5
- Published: Jun 13, 2025
- Affected: through 6.0.0.

### [CVE-2025-28381](https://cve.now/CVE-2025-28381): A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all…

- Severity: High 7.5
- Published: Jun 13, 2025
- Affected: through 6.0.0.

### [CVE-2025-28380](https://cve.now/CVE-2025-28380): A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via…

- Severity: Medium 6.1
- Published: Jun 13, 2025
- Affected: through 6.0.0.

### [CVE-2024-47529](https://cve.now/CVE-2024-47529): OpenC3 COSMOS uses clear text storage of password/token (\`GHSL-2024-129\`)

- Severity: Medium 4.8
- Published: Oct 2, 2024
- Affected: fixed in 5.19.0.

### [CVE-2024-46977](https://cve.now/CVE-2024-46977): OpenC3 COSMOS allows a path traversal via screen controller (\`GHSL-2024-127\`)

- Severity: Medium 5.3
- Published: Oct 2, 2024
- Affected: fixed in 5.19.0.

### [CVE-2024-43795](https://cve.now/CVE-2024-43795): OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (\`GHSL-2024-128\`)

- Severity: Medium 5.1
- Published: Oct 2, 2024
- Affected: fixed in 5.19.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/openc3
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.