CVE-2026-77394
Deferred Deferred - Pending Action

Stored XSS in OpenC3 COSMOS via ButtonWidget

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-77394
EUVD
EUVD-2026-85564

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
openc3 cosmos to 7.3.0 (inc)
openc3 cosmos From 5.0.6 (inc) to 7.3.0 (exc)
openc3 cosmos From 5.0.6 (inc) to 7.2.1 (inc)
openc3 cosmos 7.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77394 is a stored cross-site scripting (XSS) vulnerability in OpenC3 COSMOS versions 5.0.6 to 7.2.1. An authenticated user with system_set permission can store a malicious JavaScript payload in a BUTTON widget's action. When another user activates the button, the script executes in their browser session, potentially stealing their session token (localStorage.openc3Token) and allowing account takeover. The vulnerability stems from unsafe eval() usage in ButtonWidget.vue and a permissive Content Security Policy.

Detection Guidance

To detect this vulnerability, check if your OpenC3 COSMOS version is between 5.0.6 and 7.2.1. Inspect screens with BUTTON widgets for malicious JavaScript in their actions. Look for screens saved by users with system_set permission that may contain hidden payloads.

Impact Analysis

An attacker could exploit this to steal your session token, hijack your account, and perform actions with your privileges. The attack is stealthy as it can hide within existing screens. No additional social engineering is needed beyond tricking you into clicking a button. The impact includes unauthorized command execution, data access, and potential server-side code execution if you have script privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. The theft of session tokens and account takeover may result in unauthorized processing of personal data, breaching confidentiality obligations. Organizations using affected versions may face compliance violations and potential regulatory penalties.

Mitigation Strategies

Upgrade to OpenC3 COSMOS version 7.3.0 or later to apply the security fix. Remove unsafe eval() usage in BUTTON widgets and tighten Content Security Policy by removing unsafe-inline and unsafe-eval directives. Treat all screens as untrusted cross-user content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart