CVE-2026-77601: OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.

CVE-2026-77601 · Severity: high · CVSS 8.8 · Published 2026-09-23

OpenC3 COSMOS is a command and telemetry management system for satellite and spacecraft operations. An authenticated user can inject arbitrary operating system commands through a configuration setting used during plugin installation, leading to complete compromise of the service including access to stored telemetry, credentials, and commanding systems across all operational scopes.

Technologies: Openc3 Cosmos, openc3 (RubyGems). Vendors: Openc3, RubyGems.

Quick answers

Is CVE-2026-77601 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77601 being exploited in the wild.
How severe is CVE-2026-77601?
High severity, with a CVSS score of 8.8, published 23 September 2026.
Which products and versions are affected?
Openc3 Cosmos all versions prior to patch; openc3 (RubyGems) >= 5.12.0, <= 7.2.1, ECOSYSTEM:introduced=5.12.0,fixed=7.3.0.
Is there a fix for CVE-2026-77601?
Yes. openc3 (RubyGems): upgrade to 7.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77601 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-77601?
Check whether you run Openc3 Cosmos or openc3 (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • openc3 (RubyGems): upgrade to 7.3.0 or later
    bundle update openc3

Technical details

This is a shell metacharacter injection vulnerability in the plugin installation pipeline. The `pypi_url` configuration setting is read from the database without validation and directly interpolated into a shell command using Ruby backticks (`openc3/lib/openc3/models/plugin_model.rb:288`), rather than being passed safely as an argument array. An authenticated user can set `pypi_url` to a value like `https://pypi.org ; id > /tmp/A1_PWNED 2>&1 ; #` via the JSON-RPC `set_setting` API, then trigger plugin installation which executes the injected shell metacharacters. In the open-source edition, any authenticated session can exploit this; in Enterprise, the admin role is required. The process runs as the `openc3` user with access to Redis passwords, S3 credentials, and all operational scopes. A sibling installer (`python_package_model.rb:95`) correctly uses `ProcessManager.spawn` with an argv array and is not vulnerable.

Affected products

  • OpenC3 COSMOS all versions prior to patch

Identifiers

  • CVE-2026-77601
  • GHSA-vp3w-52v9-q57f

Timeline

  • 2026-09-23: disclosed: Advisory GHSA-vp3w-52v9-q57f published
  • 2026-01: other: CVE-2026-77601 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.