Executive brief
OpenC3 COSMOS, a platform for command and control of spacecraft and other systems, is vulnerable to a security flaw in its Command Sender interface. An attacker could trick a user into executing malicious scripts within their own browser session, potentially leading to the theft of session tokens or unauthorized data access. This risk is primarily realized if an attacker can influence the input parameters of a command, such as through a phishing attempt.
Technical details
A Self-XSS vulnerability exists in OpenC3 COSMOS versions prior to 7.0.0. The root cause is the use of the unsafe `eval()` function within the `convertToValue` method of the `CommandSender.vue` component when processing user-supplied ARRAY parameters. An attacker with low privileges can exploit this by providing a malicious JavaScript payload inside square brackets within a command's array parameter. When the 'Send' button is clicked, the payload executes in the context of the victim's browser session. This can allow the attacker to read or modify sensitive data, such as session tokens stored in local storage. The vulnerability is mitigated in version 7.0.0.
Affected products
- OpenC3 COSMOS < 7.0.0
Timeline
- 2026-04-20: disclosed: Vulnerability reported to OpenC3/cosmos repository.
- 2026-04-22: advisory: GitHub Advisory GHSA-ffq5-qpvf-xq7x published.
- 2026-05-04: other: NVD publication date.