- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 11 · 4 critical, 2 high, 5 medium
- Registry
- RubyGems
Advisories 11
- CVE-2026-77602Critical 9.9
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
Affected: from 5.1.0, fixed in 7.3.0.
- CVE-2026-77601High 8.8
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting
Affected: from 5.12.0, fixed in 7.3.0.
- CVE-2026-42088Critical 9.6
OpenC3 COSMOS: Administrative Actions via the Script Runner Tool
Affected: fixed in 7.0.0-rc3.
- CVE-2026-42087Critical 9.6
OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base
Affected: from 6.7.0, fixed in 7.0.0-rc3.
- CVE-2026-42086Medium 4.6
OpenC3 COSMOS: Self-XSS in the Command Sender
Affected: fixed in 7.0.0.
- CVE-2026-42085Medium 4.3
OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames
Affected: fixed in 6.10.5; from 7.0.0.pre.rc1, fixed in 7.0.0-rc3.
- CVE-2026-42084High 8.1
OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence
Affected: fixed in 6.10.5; from 7.0.0.pre.rc1, fixed in 7.0.0-rc3.
- CVE-2025-68271Critical 10.0
Unauthenticated Remote Code Execution in openc3-api
Affected: from 5.0.6, fixed in 6.10.2.
- CVE-2024-47529Medium 4.8
OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)
Affected: fixed in 5.19.0.
- CVE-2024-46977Medium 5.3
OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)
Affected: fixed in 5.19.0.
- CVE-2024-43795Medium 5.1
OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`)
Affected: fixed in 5.19.0.