CVE-2026-77601
Deferred Deferred - Pending Action

Command Injection in OpenC3 COSMOS

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 in openc3/lib/openc3/models/plugin_model.rb to interpolate the value into a shell command while installing a plugin with Python dependency metadata. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary operating-system commands to run as the openc3 service user with access to Redis and bucket credentials. Open-source deployments permit any authenticated user to reach the affected operations, while Enterprise deployments require an administrator. This issue is fixed in version 7.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-77601
EUVD
EUVD-2026-85563

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openc3 cosmos From 5.12.0 (inc) to 7.3.0 (inc)
openc3 cosmos From 5.12.0 (inc) to 7.3.0 (exc)
openc3 cosmos 7.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in OpenC3 COSMOS software versions 5.12.0 to 7.2.1. An authenticated user can exploit it by setting the pypi_url parameter to include shell metacharacters during plugin installation. The system then executes these commands with the privileges of the openc3 service user, allowing full access to sensitive data and system control.

Detection Guidance

Check OpenC3 COSMOS versions between 5.12.0 and 7.2.1 for the vulnerability. Inspect plugin installation logs for unusual shell commands or unexpected network activity during plugin installation. Look for files created by the openc3 service user in /tmp or other directories. Review pypi_url settings in OpenC3 configuration for suspicious values containing shell metacharacters like ;, |, or >.

Impact Analysis

An attacker could execute arbitrary commands on your system as the openc3 user, potentially stealing credentials stored in Redis or S3, accessing sensitive telemetry data, or modifying system configurations. In open-source deployments, any authenticated user can exploit this, while Enterprise deployments require admin access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Unauthorized command execution may result in data breaches, non-compliance penalties, and loss of trust in systems handling regulated data.

Mitigation Strategies

Upgrade OpenC3 COSMOS to version 7.3.0 or later immediately. If upgrading is not possible, restrict authenticated user access to plugin installation features. Review and validate all pypi_url settings in OpenC3 configuration to ensure they are valid HTTP(S) URLs. Monitor system logs for any signs of exploitation or unauthorized command execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77601. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart