# CVE-2026-77394: OpenC3 COSMOS stored cross-user XSS in BUTTON widget

Source: https://junglewise.ai/threats/cve-2026-77394-openc3-cosmos-stored-cross-user-xss-in-button-widget  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77394 · Severity: high · CVSS 7.6 · Published 2026-09-23

OpenC3 COSMOS is a command and telemetry system for spacecraft operations and mission control. Users with screen-editing permissions can inject malicious JavaScript into BUTTON widgets on shared telemetry screens. When other operators view and interact with these screens, the attacker's code executes in their authenticated browser sessions, allowing theft of session tokens and account takeover without any user interaction beyond normal job duties.

Technologies: [Openc3 Cosmos](https://junglewise.ai/threats/technologies/cosmos). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Openc3](https://junglewise.ai/threats/vendors/openc3).

## Quick answers

**Is CVE-2026-77394 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77394 being exploited in the wild.

**How severe is CVE-2026-77394?** High severity, with a CVSS score of 7.6, published 23 September 2026.

**Which products and versions are affected?** @openc3/vue-common (npm) >= 5.0.6, <= 7.2.1, SEMVER:introduced=5.0.6,fixed=7.3.0; Openc3 Cosmos 7.2.0 and likely earlier; code path present on main branch.

**Is there a fix for CVE-2026-77394?** Yes. @openc3/vue-common (npm): upgrade to 7.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77394 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77394?** Check whether you run @openc3/vue-common (npm) or Openc3 Cosmos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @openc3/vue-common (npm): upgrade to 7.3.0 or later

  ```sh
  npm install @openc3/vue-common@7.3.0
  ```


## Technical details

The vulnerability is a stored, cross-user XSS in the BUTTON widget implementation. The root cause: the BUTTON widget stores user-supplied action code as plain text in the database (no sanitization in `ScreensController#create`), then executes it via `eval()` in the browser when clicked (`ButtonWidget.vue:109`). Screens are shared across users within a scope, so JavaScript injected by user A runs in user B's authenticated session. An attacker with `system_set` permission can save a screen with a malicious BUTTON action; any user viewing that screen will execute the injected code in their security context. The payload can exfiltrate `localStorage.openc3Token` (the session bearer token) or pivot to the Script Runner for server-side code execution. The site's permissive Content-Security-Policy (`'unsafe-inline' 'unsafe-eval'`) does not block injected or eval'd code. Patch status: not yet released as of the advisory publication date.

## Affected products

- OpenC3 COSMOS 7.2.0 and likely earlier; code path present on main branch

## Identifiers

- CVE-2026-77394
- GHSA-gvf2-2rh5-mpgf

## Timeline

- 2026-09-23: disclosed: GHSA-gvf2-2rh5-mpgf published
- 2026-06-25: other: Vulnerability confirmed in version 7.2.0 (latest tested at disclosure)

## Related threats

- [OpenC3 COSMOS authenticated remote code execution via config overlay](https://junglewise.ai/threats/cve-2026-77602-openc3-cosmos-authenticated-remote-code-execution-via-config)
- [OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.](https://junglewise.ai/threats/cve-2026-77601-openc3-cosmos-authenticated-os-command-injection-via-pypi-url)
- [OpenC3 COSMOS privilege escalation via Script Runner API bypass](https://junglewise.ai/threats/cve-2026-42088-openc3-cosmos-privilege-escalation-via-script-runner-api-bypass)
- [OpenC3 COSMOS SQL injection in QuestDB Time-Series Database](https://junglewise.ai/threats/cve-2026-42087-openc3-cosmos-sql-injection-in-questdb-time-series-database)
- [OpenC3 COSMOS Self-XSS in Command Sender](https://junglewise.ai/threats/cve-2026-42086-openc3-cosmos-self-xss-in-command-sender)