OpenC3 COSMOS before version 7.0.0 contains a CWE-79 cross-site scripting vulnerability due to unsafe use of eval() on array-like command parameters in the Command Sender UI. This allows user-supplied payloads to execute in the browser context, posing a self-XSS risk. An attacker able to influence the array parameter input could execute scripts in their own session, potentially accessing or modifying data such as session tokens in local storage. The issue is fixed in version 7.0.0.

The vulnerability enables self-XSS, allowing an attacker who can influence input parameters to execute arbitrary scripts in their own authenticated browser session. This may lead to disclosure or modification of data accessible in that session, including session tokens stored in local storage. There is no indication of remote exploitation without user interaction or privilege escalation. No known exploits are reported in the wild.

Upgrade OpenC3 COSMOS to version 7.0.0 or later, where this vulnerability is patched. Since the issue is fixed in this version, no additional mitigation steps are required. Users should avoid using vulnerable versions and be cautious of phishing attempts that might trick them into executing malicious payloads.