PT-2026-36657 · Pypi+1 · Openc3

Published 2026-04-22 · Updated 2026-04-22

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions cosmos (affected versions not specified)

Description The Command Sender UI employs an unsafe eval() function when processing array-like command parameters. This allows a user-supplied payload to execute within the browser during the command sending process, leading to a self-XSS risk. An attacker could trigger script execution in a victim's session if they can influence the array parameter input, such as through phishing. Successful exploitation may allow the attacker to read or modify data within the authenticated browser context, including session tokens stored in local storage. The issue occurs in the convertToValue() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-FFQ5-QPVF-XQ7X

Affected Products

Openc3

References · 6

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/openc3/CVE-2026-42086.yml · Exploit
• https://osv.dev/vulnerability/GHSA-ffq5-qpvf-xq7x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42086 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/openc3/PYSEC-2026-105.yaml · Note
• https://github.com/OpenC3/cosmos · Note
• https://github.com/OpenC3/cosmos/security/advisories/GHSA-ffq5-qpvf-xq7x · Note