CVE-2026-77394: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in OpenC3 cosmos
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0.
AI Analysis
Technical Summary
OpenC3 COSMOS allows authenticated users with system_set permission to store a shared screen via POST /openc3-api/screen. The BUTTON widget action in the stored screen is evaluated in other operators' browser sessions by the component openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue. This leads to execution of attacker-controlled scripts in the COSMOS origin, enabling theft of localStorage.openc3Token, which can result in account takeover and unauthorized actions. The permissive content security policy aids script execution but is not the root cause. The issue affects versions >=5.0.6 and <7.3.0 and is resolved in 7.3.0.
Potential Impact
An attacker with system_set permission can execute arbitrary scripts in other users' browser sessions, stealing bearer tokens stored in localStorage. This can lead to account takeover and unauthorized actions performed with the victim's privileges. The vulnerability has a CVSS score of 7.6 (high severity), indicating significant confidentiality impact but limited integrity and no availability impact.
Mitigation Recommendations
This vulnerability is fixed in OpenC3 COSMOS version 7.3.0. Users should upgrade to version 7.3.0 or later to remediate this issue. No other mitigation or temporary workaround is indicated.
CVE-2026-77394: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in OpenC3 cosmos
Description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0.
CVSS v3.1
Score 7.6high
Affected software
OpenC3
cosmos
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenC3 COSMOS allows authenticated users with system_set permission to store a shared screen via POST /openc3-api/screen. The BUTTON widget action in the stored screen is evaluated in other operators' browser sessions by the component openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue. This leads to execution of attacker-controlled scripts in the COSMOS origin, enabling theft of localStorage.openc3Token, which can result in account takeover and unauthorized actions. The permissive content security policy aids script execution but is not the root cause. The issue affects versions >=5.0.6 and <7.3.0 and is resolved in 7.3.0.
Potential Impact
An attacker with system_set permission can execute arbitrary scripts in other users' browser sessions, stealing bearer tokens stored in localStorage. This can lead to account takeover and unauthorized actions performed with the victim's privileges. The vulnerability has a CVSS score of 7.6 (high severity), indicating significant confidentiality impact but limited integrity and no availability impact.
Mitigation Recommendations
This vulnerability is fixed in OpenC3 COSMOS version 7.3.0. Users should upgrade to version 7.3.0 or later to remediate this issue. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T19:55:27.022Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab42272f7a7c5410633c3b7
Added to database: 09/23/2026, 19:03:14 UTC
Last enriched: 09/23/2026, 19:17:47 UTC
Last updated: 09/24/2026, 02:57:38 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.