Executive brief
OpenC3 COSMOS is a command and telemetry management system for satellite and spacecraft operations. An authenticated user can inject arbitrary operating system commands through a configuration setting used during plugin installation, leading to complete compromise of the service including access to stored telemetry, credentials, and commanding systems across all operational scopes.
Technical details
This is a shell metacharacter injection vulnerability in the plugin installation pipeline. The `pypi_url` configuration setting is read from the database without validation and directly interpolated into a shell command using Ruby backticks (`openc3/lib/openc3/models/plugin_model.rb:288`), rather than being passed safely as an argument array. An authenticated user can set `pypi_url` to a value like `https://pypi.org ; id > /tmp/A1_PWNED 2>&1 ; #` via the JSON-RPC `set_setting` API, then trigger plugin installation which executes the injected shell metacharacters. In the open-source edition, any authenticated session can exploit this; in Enterprise, the admin role is required. The process runs as the `openc3` user with access to Redis passwords, S3 credentials, and all operational scopes. A sibling installer (`python_package_model.rb:95`) correctly uses `ProcessManager.spawn` with an argv array and is not vulnerable.
Affected products
- OpenC3 COSMOS all versions prior to patch
Timeline
- 2026-09-23: disclosed: Advisory GHSA-vp3w-52v9-q57f published
- 2026-01: other: CVE-2026-77601 assigned