# CVE-2024-43795: OpenC3 COSMOS cross-site scripting in login

Source: https://junglewise.ai/threats/cve-2024-43795-openc3-cosmos-cross-site-scripting-in-login  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-10-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-43795 · Severity: low · CVSS 3.1 · Published 2024-10-02

OpenC3 COSMOS is an open-source mission control and operations software platform used to manage complex systems and satellite operations. A reflected cross-site scripting vulnerability in the login functionality allows attackers to inject malicious scripts that execute in users' browsers, potentially leading to session hijacking, credential theft, or further compromise of the operations environment.

Technologies: [Openc3 Cosmos](https://junglewise.ai/threats/technologies/cosmos), [openc3 (PyPI)](https://junglewise.ai/threats/technologies/pypi-openc3), [openc3 (RubyGems)](https://junglewise.ai/threats/technologies/openc3). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Openc3](https://junglewise.ai/threats/vendors/openc3), [PyPI](https://junglewise.ai/threats/vendors/pypi), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2024-43795 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-43795 being exploited in the wild.

**How severe is CVE-2024-43795?** Low severity, with a CVSS score of 3.1, published 2 October 2024.

**Which products and versions are affected?** @openc3/tool-common (npm) SEMVER:introduced=0,fixed=5.19.0; Openc3 Cosmos before 5.19.0; openc3 (PyPI) GIT:introduced=0,fixed=762d7e0e93bdc2f340b1e42acccedc78994a576e|ECOSYSTEM:introduced=0,fixed=5.19.0; openc3 (RubyGems) ECOSYSTEM:introduced=0,fixed=5.19.0.

**Is there a fix for CVE-2024-43795?** Yes. @openc3/tool-common (npm): upgrade to 5.19.0 or later; openc3 (PyPI): upgrade to 5.19.0 or later; openc3 (RubyGems): upgrade to 5.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-43795 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2024-43795?** Check whether you run @openc3/tool-common (npm), Openc3 Cosmos, openc3 (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @openc3/tool-common (npm): upgrade to 5.19.0 or later

  ```sh
  npm install @openc3/tool-common@5.19.0
  ```

- openc3 (PyPI): upgrade to 5.19.0 or later

  ```sh
  pip install "openc3>=5.19.0"
  ```

- openc3 (RubyGems): upgrade to 5.19.0 or later

  ```sh
  bundle update openc3
  ```


## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in OpenC3 COSMOS's login functionality, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability stems from insufficient input sanitization before rendering user-controllable data in the login page. The attack is network-accessible and requires user interaction (a victim must click a crafted link), with no authentication prerequisites. An attacker can craft a malicious URL containing JavaScript payload that executes in the victim's browser within the COSMOS application context, potentially enabling session hijacking, credential harvesting, or RCE through further exploitation. The fix is available in version 5.19.0 and later. This vulnerability affects the Open Source Edition only, not the Enterprise Edition.

## Affected products

- OpenC3 COSMOS before 5.19.0

## Identifiers

- CVE-2024-43795
- GHSA-vfj8-5pj7-2f9g
- PYSEC-2024-100

## Timeline

- 2024-10-02: disclosed
- 2024-10-02: patched: Version 5.19.0 released

## References

- [https://github.com/OpenC3/cosmos/security/advisories/GHSA-vfj8-5pj7-2f9g](https://github.com/OpenC3/cosmos/security/advisories/GHSA-vfj8-5pj7-2f9g)

## Related threats

- [OpenC3 COSMOS authenticated remote code execution via config overlay](https://junglewise.ai/threats/cve-2026-77602-openc3-cosmos-authenticated-remote-code-execution-via-config)
- [OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.](https://junglewise.ai/threats/cve-2026-77601-openc3-cosmos-authenticated-os-command-injection-via-pypi-url)
- [OpenC3 COSMOS stored cross-user XSS in BUTTON widget](https://junglewise.ai/threats/cve-2026-77394-openc3-cosmos-stored-cross-user-xss-in-button-widget)
- [OpenC3 COSMOS privilege escalation via Script Runner API bypass](https://junglewise.ai/threats/cve-2026-42088-openc3-cosmos-privilege-escalation-via-script-runner-api-bypass)
- [OpenC3 COSMOS SQL injection in QuestDB Time-Series Database](https://junglewise.ai/threats/cve-2026-42087-openc3-cosmos-sql-injection-in-questdb-time-series-database)