CVE-2026-42086: OpenC3 COSMOS Self-XSS in Command Sender

CVE-2026-42086 · Severity: medium · CVSS 4.6 · Published 2026-05-04

OpenC3 COSMOS, a platform for command and control of spacecraft and other systems, is vulnerable to a security flaw in its Command Sender interface. An attacker could trick a user into executing malicious scripts within their own browser session, potentially leading to the theft of session tokens or unauthorized data access. This risk is primarily realized if an attacker can influence the input parameters of a command, such as through a phishing attempt.

Technologies: Openc3 Cosmos, openc3 (PyPI), openc3 (RubyGems). Vendors: Openc3, PyPI, RubyGems.

Quick answers

Is CVE-2026-42086 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42086 being exploited in the wild.
How severe is CVE-2026-42086?
Medium severity, with a CVSS score of 4.6, published 4 May 2026.
Which products and versions are affected?
Openc3 Cosmos < 7.0.0; openc3 (PyPI) ECOSYSTEM:introduced=0,fixed=7.0.0; openc3 (RubyGems) < 7.0.0, ECOSYSTEM:introduced=0,fixed=7.0.0.
Is there a fix for CVE-2026-42086?
Yes. openc3 (PyPI): upgrade to 7.0.0 or later; openc3 (RubyGems): upgrade to 7.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42086 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42086?
Check whether you run Openc3 Cosmos, openc3 (PyPI) or openc3 (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • openc3 (PyPI): upgrade to 7.0.0 or later
    pip install "openc3>=7.0.0"
  • openc3 (RubyGems): upgrade to 7.0.0 or later
    bundle update openc3

Technical details

A Self-XSS vulnerability exists in OpenC3 COSMOS versions prior to 7.0.0. The root cause is the use of the unsafe `eval()` function within the `convertToValue` method of the `CommandSender.vue` component when processing user-supplied ARRAY parameters. An attacker with low privileges can exploit this by providing a malicious JavaScript payload inside square brackets within a command's array parameter. When the 'Send' button is clicked, the payload executes in the context of the victim's browser session. This can allow the attacker to read or modify sensitive data, such as session tokens stored in local storage. The vulnerability is mitigated in version 7.0.0.

Affected products

  • OpenC3 COSMOS < 7.0.0

Identifiers

  • CVE-2026-42086
  • GHSA-ffq5-qpvf-xq7x
  • PYSEC-2026-105

Timeline

  • 2026-04-20: disclosed: Vulnerability reported to OpenC3/cosmos repository.
  • 2026-04-22: advisory: GitHub Advisory GHSA-ffq5-qpvf-xq7x published.
  • 2026-05-04: other: NVD publication date.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.