PT-2026-36880 · Unknown · Openc3 Cosmos

Ctrlsill · Published 2026-04-22 · Updated 2026-05-08 · CVE-2026-42086

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions prior to 7.0.0

Description The Command Sender UI uses an unsafe eval() function on array-like command parameters. This allows a user-supplied payload to execute in the browser when sending a command, creating a self-XSS (Cross-Site Scripting) risk. An attacker could trigger script execution in a victim's session if they can influence the array parameter input, such as through phishing. Successful exploitation may allow an attacker to read or modify data within the authenticated browser context, including session tokens stored in local storage.

Recommendations Update to version 7.0.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42086

GHSA-FFQ5-QPVF-XQ7X

PYSEC-2026-105

Affected Products

Openc3 Cosmos

References · 11

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/openc3/CVE-2026-42086.yml · Exploit
• 🔥 https://github.com/OpenC3/cosmos/security/advisories/GHSA-ffq5-qpvf-xq7x · Exploit
• https://osv.dev/vulnerability/PYSEC-2026-105 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42086 · Security Note
• https://osv.dev/vulnerability/GHSA-ffq5-qpvf-xq7x · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/openc3/PYSEC-2026-105.yaml · Note
• https://github.com/OpenC3/cosmos · Note
• https://twitter.com/CVEnew/status/2051361264975196178 · Twitter Post
• https://t.me/cveNotify/162784 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2051390853411672164 · Twitter Post
• https://t.me/cveNotify/162546 · Telegram Post