# openc3 (RubyGems) vulnerabilities

11 known vulnerabilities (4 critical, 2 high, 5 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://rubygems.org/gems/openc3

## Advisories (11)

### [CVE-2026-77602](https://cve.now/CVE-2026-77602): OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

- Severity: Critical 9.9
- Published: Sep 23, 2026
- Affected: from 5.1.0, fixed in 7.3.0.

### [CVE-2026-77601](https://cve.now/CVE-2026-77601): OpenC3 COSMOS: Authenticated OS command injection via the \`pypi\_url\` setting

- Severity: High 8.8
- Published: Sep 23, 2026
- Affected: from 5.12.0, fixed in 7.3.0.

### [CVE-2026-42088](https://cve.now/CVE-2026-42088): OpenC3 COSMOS: Administrative Actions via the Script Runner Tool

- Severity: Critical 9.6
- Published: May 4, 2026
- Affected: fixed in 7.0.0-rc3.

### [CVE-2026-42087](https://cve.now/CVE-2026-42087): OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base

- Severity: Critical 9.6
- Published: May 4, 2026
- Affected: from 6.7.0, fixed in 7.0.0-rc3.

### [CVE-2026-42086](https://cve.now/CVE-2026-42086): OpenC3 COSMOS: Self-XSS in the Command Sender

- Severity: Medium 4.6
- Published: May 4, 2026
- Affected: fixed in 7.0.0.

### [CVE-2026-42085](https://cve.now/CVE-2026-42085): OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames

- Severity: Medium 4.3
- Published: May 4, 2026
- Affected: fixed in 6.10.5; from 7.0.0.pre.rc1, fixed in 7.0.0-rc3.

### [CVE-2026-42084](https://cve.now/CVE-2026-42084): OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

- Severity: High 8.1
- Published: May 4, 2026
- Affected: fixed in 6.10.5; from 7.0.0.pre.rc1, fixed in 7.0.0-rc3.

### [CVE-2025-68271](https://cve.now/CVE-2025-68271): Unauthenticated Remote Code Execution in openc3-api

- Severity: Critical 10.0
- Published: Jan 13, 2026
- Affected: from 5.0.6, fixed in 6.10.2.

### [CVE-2024-47529](https://cve.now/CVE-2024-47529): OpenC3 COSMOS uses clear text storage of password/token (\`GHSL-2024-129\`)

- Severity: Medium 4.8
- Published: Oct 2, 2024
- Affected: fixed in 5.19.0.

### [CVE-2024-46977](https://cve.now/CVE-2024-46977): OpenC3 COSMOS allows a path traversal via screen controller (\`GHSL-2024-127\`)

- Severity: Medium 5.3
- Published: Oct 2, 2024
- Affected: fixed in 5.19.0.

### [CVE-2024-43795](https://cve.now/CVE-2024-43795): OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (\`GHSL-2024-128\`)

- Severity: Medium 5.1
- Published: Oct 2, 2024
- Affected: fixed in 5.19.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/rubygems/openc3
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.