# CVE-2026-77601: OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.

Source: https://junglewise.ai/threats/cve-2026-77601-openc3-cosmos-authenticated-os-command-injection-via-pypi-url  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77601 · Severity: high · CVSS 8.8 · Published 2026-09-23

OpenC3 COSMOS is a command and telemetry management system for satellite and spacecraft operations. An authenticated user can inject arbitrary operating system commands through a configuration setting used during plugin installation, leading to complete compromise of the service including access to stored telemetry, credentials, and commanding systems across all operational scopes.

Technologies: [Openc3 Cosmos](https://junglewise.ai/threats/technologies/cosmos), [openc3 (RubyGems)](https://junglewise.ai/threats/technologies/openc3). Vendors: [Openc3](https://junglewise.ai/threats/vendors/openc3), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-77601 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77601 being exploited in the wild.

**How severe is CVE-2026-77601?** High severity, with a CVSS score of 8.8, published 23 September 2026.

**Which products and versions are affected?** Openc3 Cosmos all versions prior to patch; openc3 (RubyGems) >= 5.12.0, <= 7.2.1, ECOSYSTEM:introduced=5.12.0,fixed=7.3.0.

**Is there a fix for CVE-2026-77601?** Yes. openc3 (RubyGems): upgrade to 7.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77601 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-77601?** Check whether you run Openc3 Cosmos or openc3 (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- openc3 (RubyGems): upgrade to 7.3.0 or later

  ```sh
  bundle update openc3
  ```


## Technical details

This is a shell metacharacter injection vulnerability in the plugin installation pipeline. The `pypi_url` configuration setting is read from the database without validation and directly interpolated into a shell command using Ruby backticks (`openc3/lib/openc3/models/plugin_model.rb:288`), rather than being passed safely as an argument array. An authenticated user can set `pypi_url` to a value like `https://pypi.org ; id > /tmp/A1_PWNED 2>&1 ; #` via the JSON-RPC `set_setting` API, then trigger plugin installation which executes the injected shell metacharacters. In the open-source edition, any authenticated session can exploit this; in Enterprise, the admin role is required. The process runs as the `openc3` user with access to Redis passwords, S3 credentials, and all operational scopes. A sibling installer (`python_package_model.rb:95`) correctly uses `ProcessManager.spawn` with an argv array and is not vulnerable.

## Affected products

- OpenC3 COSMOS all versions prior to patch

## Identifiers

- CVE-2026-77601
- GHSA-vp3w-52v9-q57f

## Timeline

- 2026-09-23: disclosed: Advisory GHSA-vp3w-52v9-q57f published
- 2026-01: other: CVE-2026-77601 assigned

## Related threats

- [OpenC3 COSMOS authenticated remote code execution via config overlay](https://junglewise.ai/threats/cve-2026-77602-openc3-cosmos-authenticated-remote-code-execution-via-config)
- [OpenC3 COSMOS stored cross-user XSS in BUTTON widget](https://junglewise.ai/threats/cve-2026-77394-openc3-cosmos-stored-cross-user-xss-in-button-widget)
- [OpenC3 COSMOS privilege escalation via Script Runner API bypass](https://junglewise.ai/threats/cve-2026-42088-openc3-cosmos-privilege-escalation-via-script-runner-api-bypass)
- [OpenC3 COSMOS SQL injection in QuestDB Time-Series Database](https://junglewise.ai/threats/cve-2026-42087-openc3-cosmos-sql-injection-in-questdb-time-series-database)
- [OpenC3 COSMOS Self-XSS in Command Sender](https://junglewise.ai/threats/cve-2026-42086-openc3-cosmos-self-xss-in-command-sender)