CVE-2026-77602: CWE-94: Improper Control of Generation of Code ('Code Injection') in OpenC3 cosmos
CVE-2026-77602 is a critical code injection vulnerability in OpenC3 cosmos versions 5.1.0 through 7.2.x. Authenticated non-administrator users can write code that is later executed with higher privileges than intended, allowing unauthorized code execution. The vulnerability arises from improper control of code generation through multiple configuration and script processing paths. This issue is fixed in version 7.3.0.
AI Analysis
Technical Summary
OpenC3 COSMOS versions from 5.1.0 up to but not including 7.3.0 allow authenticated non-administrator users to write content under targets_modified/ that is executed by various configuration and microservice components with elevated privileges. The processing involves ConfigParser, PacketConfig, GENERIC_READ_CONVERSION, GENERIC_WRITE_CONVERSION, and script execution via openc3-cosmos-script-runner-api. This improper control of code generation (CWE-94) enables code injection and execution with access to internal credentials and data. The vulnerability is resolved in version 7.3.0.
Potential Impact
Successful exploitation allows authenticated non-administrator users to execute arbitrary code with elevated privileges within the OpenC3 cosmos environment. This can lead to full compromise of the affected system, including access to internal credentials and sensitive data. The CVSS v3.1 score is 9.9 (critical), reflecting network attack vector, low attack complexity, required privileges of a non-administrator user, no user interaction, and complete confidentiality, integrity, and availability impact.
Mitigation Recommendations
Upgrade OpenC3 cosmos to version 7.3.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data.
CVE-2026-77602: CWE-94: Improper Control of Generation of Code ('Code Injection') in OpenC3 cosmos
Description
CVE-2026-77602 is a critical code injection vulnerability in OpenC3 cosmos versions 5.1.0 through 7.2.x. Authenticated non-administrator users can write code that is later executed with higher privileges than intended, allowing unauthorized code execution. The vulnerability arises from improper control of code generation through multiple configuration and script processing paths. This issue is fixed in version 7.3.0.
CVSS v3.1
Score 9.9critical
Affected software
OpenC3
cosmos
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenC3 COSMOS versions from 5.1.0 up to but not including 7.3.0 allow authenticated non-administrator users to write content under targets_modified/ that is executed by various configuration and microservice components with elevated privileges. The processing involves ConfigParser, PacketConfig, GENERIC_READ_CONVERSION, GENERIC_WRITE_CONVERSION, and script execution via openc3-cosmos-script-runner-api. This improper control of code generation (CWE-94) enables code injection and execution with access to internal credentials and data. The vulnerability is resolved in version 7.3.0.
Potential Impact
Successful exploitation allows authenticated non-administrator users to execute arbitrary code with elevated privileges within the OpenC3 cosmos environment. This can lead to full compromise of the affected system, including access to internal credentials and sensitive data. The CVSS v3.1 score is 9.9 (critical), reflecting network attack vector, low attack complexity, required privileges of a non-administrator user, no user interaction, and complete confidentiality, integrity, and availability impact.
Mitigation Recommendations
Upgrade OpenC3 cosmos to version 7.3.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T20:48:20.507Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab42272f7a7c5410633c3ae
Added to database: 09/23/2026, 19:03:14 UTC
Last enriched: 09/23/2026, 19:18:45 UTC
Last updated: 09/24/2026, 00:45:04 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.