Vulnerability · Published May 4, 2026 · Assigned by GitHub_M

CVE-2026-42086OpenC3 COSMOS: Self-XSS in the Command Sender

Medium 4.6

In plain English

A medium-severity cross-site scripting in cosmos from OpenC3. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.2%top 90.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage. This issue has been patched in version 7.0.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	openc3	7.0.0	GHSA-ffq5-qpvf-xq7x
PyPI	openc3	7.0.0	PYSEC-2026-105
RubyGems	openc3	7.0.0	GHSA-ffq5-qpvf-xq7x

Affected products (as reported)

Vendor	Product	Versions
OpenC3	cosmos	< 7.0.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/OpenC3/cosmos/security/advisories/GHSA-ffq5-qpvf-xq7x x_refsource_CONFIRM