OpenC3 vulnerabilities
We track 8 vulnerabilities in OpenC3 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on September 23, 2026.
Latest OpenC3 vulnerabilities
- 9.9 Critical severity
cosmos: Improper Control of Generation of Code
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later executed by multiple c
- 8.8 High severity
cosmos: Improper Neutralization of Special Elements used in an OS Command
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC
- 7.6 High severity
cosmos: Improper Neutralization of Input During Web Page Generation
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BU
- 8.1 High severity
cosmos: Execution with Unnecessary Privileges
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-
- 9.6 Critical severity
cosmos: Improper Neutralization of Special Elements used in an SQL Command
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS.
- 8.1 High severity
cosmos: Unverified Password Change
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing th
- 10.0 Critical severity
cosmos: Improper Neutralization of Directives in Dynamically Evaluated Code
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.0 to 6.10.1, OpenC3 COSMOS contains a critical remote code execution vulnerability reachable through the JSON-RPC API. When a JSON-
- 9.8 Critical severity
Cosmos: Improper Control of Generation of Code
A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.