# CVE-2024-47529: OpenC3 COSMOS cleartext password storage in browser localStorage

Source: https://junglewise.ai/threats/cve-2024-47529-openc3-cosmos-cleartext-password-storage-in-browser-localstorage  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-10-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-47529 · Severity: low · CVSS 3.1 · Published 2024-10-02

OpenC3 COSMOS is a web-based satellite control and equipment testing platform. The application stores user passwords unencrypted in the browser's LocalStorage, making them vulnerable to theft if an attacker can execute JavaScript in the user's session (via cross-site scripting). This could allow attackers to harvest user credentials or hijack sessions, particularly dangerous given that the platform is used to control critical infrastructure like satellites.

Technologies: [Openc3 Cosmos](https://junglewise.ai/threats/technologies/cosmos), [openc3 (PyPI)](https://junglewise.ai/threats/technologies/pypi-openc3), [openc3 (RubyGems)](https://junglewise.ai/threats/technologies/openc3). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Openc3](https://junglewise.ai/threats/vendors/openc3), [PyPI](https://junglewise.ai/threats/vendors/pypi), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2024-47529 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-47529 being exploited in the wild.

**How severe is CVE-2024-47529?** Low severity, with a CVSS score of 3.1, published 2 October 2024.

**Which products and versions are affected?** @openc3/tool-common (npm) SEMVER:introduced=0,fixed=5.19.0; Openc3 Cosmos < 5.19.0; openc3 (PyPI) GIT:introduced=0,fixed=b5ab34fe7fa54c0c8171c4aa3caf4e03d6f63bd7|ECOSYSTEM:introduced=0,fixed=5.19.0; openc3 (RubyGems) ECOSYSTEM:introduced=0,fixed=5.19.0.

**Is there a fix for CVE-2024-47529?** Yes. @openc3/tool-common (npm): upgrade to 5.19.0 or later; openc3 (PyPI): upgrade to 5.19.0 or later; openc3 (RubyGems): upgrade to 5.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-47529 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2024-47529?** Check whether you run @openc3/tool-common (npm), Openc3 Cosmos, openc3 (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @openc3/tool-common (npm): upgrade to 5.19.0 or later

  ```sh
  npm install @openc3/tool-common@5.19.0
  ```

- openc3 (PyPI): upgrade to 5.19.0 or later

  ```sh
  pip install "openc3>=5.19.0"
  ```

- openc3 (RubyGems): upgrade to 5.19.0 or later

  ```sh
  bundle update openc3
  ```


## Technical details

OpenC3 COSMOS stores user authentication passwords as cleartext in the web browser's LocalStorage, violating secure credential storage practices (CWE-312, CWE-522). When combined with XSS vulnerabilities (GHSL-2024-128), an attacker can inject malicious JavaScript into a victim's session to directly read `localStorage.openc3Token` or the password field, then exfiltrate these credentials. The attack requires the victim to access a malicious redirect parameter on the login page; no special privileges are needed beyond network access to the COSMOS instance. The vulnerability was fixed in version 5.19.0 by switching to session token-based authentication instead of storing passwords client-side.

## Affected products

- OpenC3 COSMOS < 5.19.0
- OpenC3 openc3 (RubyGems) 5.0.6 through 5.18.0
- OpenC3 @openc3/tool-common (npm) < 5.19.0
- OpenC3 openc3 (PyPI) 0.1.0, 5.9.2b0 through 5.18.0

## Identifiers

- CVE-2024-47529
- GHSA-4xqv-47rm-37mm
- PYSEC-2024-121

## Timeline

- 2024-07-01: disclosed: Vulnerabilities reported via GitHub private vulnerability reporting
- 2024-10-02: patched: OpenC3 COSMOS v5.19.0 released with fixes
- 2024-10-02: advisory: GHSA-4xqv-47rm-37mm, CVE-2024-47529, PYSEC-2024-121 published

## References

- [https://github.com/OpenC3/cosmos/security/advisories/GHSA-4xqv-47rm-37mm](https://github.com/OpenC3/cosmos/security/advisories/GHSA-4xqv-47rm-37mm)
- [https://github.com/OpenC3/cosmos/commit/b5ab34fe7fa54c0c8171c4aa3caf4e03d6f63bd7](https://github.com/OpenC3/cosmos/commit/b5ab34fe7fa54c0c8171c4aa3caf4e03d6f63bd7)
- [https://github.com/OpenC3/cosmos](https://github.com/OpenC3/cosmos)
- [https://github.com/pypa/advisory-database/tree/main/vulns/openc3/PYSEC-2024-121.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/openc3/PYSEC-2024-121.yaml)

## Related threats

- [OpenC3 COSMOS authenticated remote code execution via config overlay](https://junglewise.ai/threats/cve-2026-77602-openc3-cosmos-authenticated-remote-code-execution-via-config)
- [OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.](https://junglewise.ai/threats/cve-2026-77601-openc3-cosmos-authenticated-os-command-injection-via-pypi-url)
- [OpenC3 COSMOS stored cross-user XSS in BUTTON widget](https://junglewise.ai/threats/cve-2026-77394-openc3-cosmos-stored-cross-user-xss-in-button-widget)
- [OpenC3 COSMOS privilege escalation via Script Runner API bypass](https://junglewise.ai/threats/cve-2026-42088-openc3-cosmos-privilege-escalation-via-script-runner-api-bypass)
- [OpenC3 COSMOS SQL injection in QuestDB Time-Series Database](https://junglewise.ai/threats/cve-2026-42087-openc3-cosmos-sql-injection-in-questdb-time-series-database)