CVE-2025-68271
Critical Remote Code Execution in OpenC3 COSMOS JSON-RPC API
Publication date: 2026-01-13
Last updated on: 2026-01-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openc3 | cosmos | From 5.0.6 (inc) to 6.10.1 (inc) |
| openc3 | cosmos | 6.10.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-95 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-68271 is a critical remote code execution vulnerability in OpenC3 COSMOS versions 5.0.0 to 6.10.1. It occurs because certain JSON-RPC API calls accept attacker-controlled text parameters that are parsed using Ruby's String#convert_to_value method. For array-like inputs, this method uses eval(), which executes the input as code. The vulnerability is severe because the command string is parsed and evaluated before authorization checks, allowing an unauthenticated attacker to execute arbitrary Ruby code remotely, even though the request eventually fails authorization. [1]
How can this vulnerability impact me? :
This vulnerability can have a critical impact as it allows remote attackers to execute arbitrary code on the affected system without any privileges or user interaction. This can lead to full system compromise, including unauthorized access, data theft, data modification, and denial of service. The CVSS score of 10.0 reflects its high severity, indicating that confidentiality, integrity, and availability of the system can all be severely affected. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can focus on monitoring JSON-RPC API requests to OpenC3 COSMOS versions 5.0.6 through 6.10.1 for suspicious or malformed parameter text that might be parsed using eval(). Specifically, look for JSON-RPC calls containing array-like inputs with unusual Ruby code or eval patterns. Network traffic inspection tools or API logging can be used to identify such requests. However, no specific detection commands are provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade OpenC3 COSMOS to version 6.10.2 or later, where this vulnerability is fixed. Until the upgrade can be applied, restrict or block access to the JSON-RPC API from untrusted networks to prevent unauthenticated attackers from exploiting the vulnerability. [1]