Vulnerability-Lookup

CVE-2026-77601 (GCVE-0-2026-77601)

Vulnerability from cvelistv5 – Published: 2026-09-23 18:50 – Updated: 2026-09-23 19:28

Title

OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

Summary

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 in openc3/lib/openc3/models/plugin_model.rb to interpolate the value into a shell command while installing a plugin with Python dependency metadata. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary operating-system commands to run as the openc3 service user with access to Redis and bucket credentials. Open-source deployments permit any authenticated user to reach the affected operations, while Enterprise deployments require an administrator. This issue is fixed in version 7.3.0.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 19:28 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/OpenC3/cosmos/security/advisor…	x_refsource_CONFIRM
https://github.com/OpenC3/cosmos/pull/3489	x_refsource_MISC
https://github.com/OpenC3/cosmos/commit/be70d1d83…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
OpenC3	cosmos	Affected: >= 5.12.0, < 7.3.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77601",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:28:30.534617Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:28:50.877Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cosmos",
          "vendor": "OpenC3",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.12.0, \u003c 7.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 in openc3/lib/openc3/models/plugin_model.rb to interpolate the value into a shell command while installing a plugin with Python dependency metadata. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary operating-system commands to run as the openc3 service user with access to Redis and bucket credentials. Open-source deployments permit any authenticated user to reach the affected operations, while Enterprise deployments require an administrator. This issue is fixed in version 7.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:50:15.333Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f"
        },
        {
          "name": "https://github.com/OpenC3/cosmos/pull/3489",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenC3/cosmos/pull/3489"
        },
        {
          "name": "https://github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b"
        }
      ],
      "source": {
        "advisory": "GHSA-vp3w-52v9-q57f",
        "discovery": "UNKNOWN"
      },
      "title": "OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77601",
    "datePublished": "2026-09-23T18:50:15.333Z",
    "dateReserved": "2026-08-20T20:48:20.507Z",
    "dateUpdated": "2026-09-23T19:28:50.877Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-77601",
      "date": "2026-09-24",
      "epss": "0.00581",
      "percentile": "0.45328"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "cosmos",
                "vendor": "OpenC3",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 5.12.0, \u003c 7.3.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 in openc3/lib/openc3/models/plugin_model.rb to interpolate the value into a shell command while installing a plugin with Python dependency metadata. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary operating-system commands to run as the openc3 service user with access to Redis and bucket credentials. Open-source deployments permit any authenticated user to reach the affected operations, while Enterprise deployments require an administrator. This issue is fixed in version 7.3.0."
          }
        ],
        "id": "CVE-2026-77601",
        "lastModified": "2026-09-23T20:17:16.027",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-77601",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:28:30.534617Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-23T19:19:18.380",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/OpenC3/cosmos/pull/3489"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-78"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-77601",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-23T19:28:30.534617Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-23T19:28:48.280Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "cosmos",
              "vendor": "OpenC3",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 5.12.0, \u003c 7.3.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 in openc3/lib/openc3/models/plugin_model.rb to interpolate the value into a shell command while installing a plugin with Python dependency metadata. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary operating-system commands to run as the openc3 service user with access to Redis and bucket credentials. Open-source deployments permit any authenticated user to reach the affected operations, while Enterprise deployments require an administrator. This issue is fixed in version 7.3.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-78",
                  "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-23T18:50:15.333Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f"
            },
            {
              "name": "https://github.com/OpenC3/cosmos/pull/3489",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/OpenC3/cosmos/pull/3489"
            },
            {
              "name": "https://github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b"
            }
          ],
          "source": {
            "advisory": "GHSA-vp3w-52v9-q57f",
            "discovery": "UNKNOWN"
          },
          "title": "OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-77601",
        "datePublished": "2026-09-23T18:50:15.333Z",
        "dateReserved": "2026-08-20T20:48:20.507Z",
        "dateUpdated": "2026-09-23T19:28:50.877Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-77601

Vulnerability from fkie_nvd - Published: 2026-09-23 19:19 - Updated: 2026-09-23 20:17

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b
	security-advisories@github.com	https://github.com/OpenC3/cosmos/pull/3489
	security-advisories@github.com	https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "cosmos",
          "vendor": "OpenC3",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.12.0, \u003c 7.3.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 in openc3/lib/openc3/models/plugin_model.rb to interpolate the value into a shell command while installing a plugin with Python dependency metadata. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary operating-system commands to run as the openc3 service user with access to Redis and bucket credentials. Open-source deployments permit any authenticated user to reach the affected operations, while Enterprise deployments require an administrator. This issue is fixed in version 7.3.0."
    }
  ],
  "id": "CVE-2026-77601",
  "lastModified": "2026-09-23T20:17:16.027",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77601",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-23T19:28:30.534617Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-23T19:19:18.380",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OpenC3/cosmos/pull/3489"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-VP3W-52V9-Q57F

Vulnerability from github – Published: 2026-09-23 18:51 – Updated: 2026-09-23 18:51

Summary

OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

Details

Summary

An authenticated user can execute arbitrary operating system commands on the openc3-cosmos-cmd-tlm-api service. The pypi_url setting is interpolated, unescaped, into a command line that is run through a shell backtick when a plugin is installed. Shell metacharacters in the setting value are executed by /bin/sh.

Details

The pypi_url value is written through the set_setting API method, reachable over the JSON-RPC endpoint POST /openc3-api/api. In the open-source edition, authorize (openc3/lib/openc3/utilities/authorization.rb) verifies only that the session token is valid and returns the anonymous user; the permission: argument is not enforced, so any authenticated user can write the setting and install a plugin. In the Enterprise edition these actions require the admin role.

During plugin install, PluginModel.install_phase2 reads the setting and builds the argument string, then runs it through a backtick (openc3/lib/openc3/models/plugin_model.rb:288):

pypi_url = get_setting('pypi_url', scope: scope)   # attacker-controlled, no validation
pypi_url += '/simple' if pypi_url
pip_args = "-i #{pypi_url} -r #{requirements_path}"
output = `/openc3/bin/pipinstall #{pip_args}`        # Ruby backtick -> /bin/sh -c

get_setting appends /simple to the stored value, and a trailing # comments out that suffix and the remainder of the argument string. The python install branch runs whenever the installed plugin contains a requirements.txt or pyproject.toml, which the actor controls because they supply the plugin gem.

The sibling installer openc3/lib/openc3/models/python_package_model.rb:95 performs the same pipinstall invocation using an argv array through ProcessManager.spawn, which does not involve a shell and is not injectable. plugin_model.rb:288 is the single site that uses a backtick.

PoC

Confirmed end-to-end over HTTP against a booted openc3-cosmos-cmd-tlm-api (puma) with Redis and bucket storage. Every request is authenticated.

Obtain a session token: POST /openc3-api/auth/verify {"password":"<password>"}
Write the setting (JSON-RPC): POST /openc3-api/api {"jsonrpc":"2.0","method":"set_setting", "params":["pypi_url","https://pypi.org ; id > /tmp/A1_PWNED 2>&1 ; #"], "keyword_params":{"scope":"DEFAULT"},"id":1}
Upload a plugin gem that contains a requirements.txt: POST /openc3-api/plugins (multipart: plugin=@malicious.gem, scope=DEFAULT)
Install it: POST /openc3-api/plugins/install/<id> (plugin_hash from step 3, scope=DEFAULT)

The injected command executed inside the install process. Contents of the marker file written by the payload:

uid=1001(openc3) gid=1001(openc3) groups=1001(openc3)

Impact

Arbitrary OS command execution as the openc3 user (uid 1001) inside the cmd-tlm-api container. That process holds the Redis/Valkey password and the bucket (S3) credentials and operates across every scope, so command execution there exposes stored telemetry, commanding, and credentials, and allows tampering with any scope.

In the Enterprise edition the prerequisite is the admin role; the admin already has plugin-driven code execution by design, so the practical effect there is that a configuration value becomes a shell command rather than a new privilege boundary being crossed. In the open-source edition any authenticated user reaches it.

Suggested fix

Run pipinstall through an argv array instead of a shell, matching python_package_model.rb:95:

pip_argv = ["-i", pypi_url]
pip_argv += ["--trusted-host", URI.parse(pypi_url).host] unless ENV['PIP_ENABLE_TRUSTED_HOST'].nil?
pip_argv += File.exist?(pyproject_path) ? [gem_path] : ["-r", requirements_path]
OpenC3::ProcessManager.instance.spawn(["/openc3/bin/pipinstall"] + pip_argv, "plugin_pip_install", File.basename(gem_path), Time.now + 3600.0, scope: scope)

Optionally also validate pypi_url as an http(s) URL when the setting is written.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.2.1"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "openc3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.12.0"
            },
            {
              "fixed": "7.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77601"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-23T18:51:01Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\nAn authenticated user can execute arbitrary operating system commands on the `openc3-cosmos-cmd-tlm-api` service. The `pypi_url` setting is interpolated, unescaped, into a command line that is run through a shell backtick when a plugin is installed. Shell metacharacters in the setting value are executed by `/bin/sh`.\n\n## Details\nThe `pypi_url` value is written through the `set_setting` API method, reachable over the JSON-RPC endpoint `POST /openc3-api/api`. In the open-source edition, `authorize` (`openc3/lib/openc3/utilities/authorization.rb`) verifies only that the session token is valid and returns the anonymous user; the `permission:` argument is not enforced, so any authenticated user can write the setting and install a plugin. In the Enterprise edition these actions require the admin role.\n\nDuring plugin install, `PluginModel.install_phase2` reads the setting and builds the argument string, then runs it through a backtick (`openc3/lib/openc3/models/plugin_model.rb:288`):\n\n```ruby\npypi_url = get_setting(\u0027pypi_url\u0027, scope: scope)   # attacker-controlled, no validation\npypi_url += \u0027/simple\u0027 if pypi_url\npip_args = \"-i #{pypi_url} -r #{requirements_path}\"\noutput = `/openc3/bin/pipinstall #{pip_args}`        # Ruby backtick -\u003e /bin/sh -c\n```\n\n`get_setting` appends `/simple` to the stored value, and a trailing `#` comments out that suffix and the remainder of the argument string. The python install branch runs whenever the installed plugin contains a `requirements.txt` or `pyproject.toml`, which the actor controls because they supply the plugin gem.\n\nThe sibling installer `openc3/lib/openc3/models/python_package_model.rb:95` performs the same `pipinstall` invocation using an argv array through `ProcessManager.spawn`, which does not involve a shell and is not injectable. `plugin_model.rb:288` is the single site that uses a backtick.\n\n## PoC\nConfirmed end-to-end over HTTP against a booted `openc3-cosmos-cmd-tlm-api` (puma) with Redis and bucket storage. Every request is authenticated.\n\n1. Obtain a session token:\n   ```\n   POST /openc3-api/auth/verify    {\"password\":\"\u003cpassword\u003e\"}\n   ```\n2. Write the setting (JSON-RPC):\n   ```\n   POST /openc3-api/api\n   {\"jsonrpc\":\"2.0\",\"method\":\"set_setting\",\n    \"params\":[\"pypi_url\",\"https://pypi.org ; id \u003e /tmp/A1_PWNED 2\u003e\u00261 ; #\"],\n    \"keyword_params\":{\"scope\":\"DEFAULT\"},\"id\":1}\n   ```\n3. Upload a plugin gem that contains a `requirements.txt`:\n   ```\n   POST /openc3-api/plugins     (multipart: plugin=@malicious.gem, scope=DEFAULT)\n   ```\n4. Install it:\n   ```\n   POST /openc3-api/plugins/install/\u003cid\u003e    (plugin_hash from step 3, scope=DEFAULT)\n   ```\n\nThe injected command executed inside the install process. Contents of the marker file written by the payload:\n```\nuid=1001(openc3) gid=1001(openc3) groups=1001(openc3)\n```\n\n## Impact\nArbitrary OS command execution as the `openc3` user (uid 1001) inside the cmd-tlm-api container. That process holds the Redis/Valkey password and the bucket (S3) credentials and operates across every scope, so command execution there exposes stored telemetry, commanding, and credentials, and allows tampering with any scope.\n\nIn the Enterprise edition the prerequisite is the admin role; the admin already has plugin-driven code execution by design, so the practical effect there is that a configuration value becomes a shell command rather than a new privilege boundary being crossed. In the open-source edition any authenticated user reaches it.\n\n## Suggested fix\nRun `pipinstall` through an argv array instead of a shell, matching `python_package_model.rb:95`:\n\n```ruby\npip_argv = [\"-i\", pypi_url]\npip_argv += [\"--trusted-host\", URI.parse(pypi_url).host] unless ENV[\u0027PIP_ENABLE_TRUSTED_HOST\u0027].nil?\npip_argv += File.exist?(pyproject_path) ? [gem_path] : [\"-r\", requirements_path]\nOpenC3::ProcessManager.instance.spawn([\"/openc3/bin/pipinstall\"] + pip_argv, \"plugin_pip_install\", File.basename(gem_path), Time.now + 3600.0, scope: scope)\n```\n\nOptionally also validate `pypi_url` as an `http(s)` URL when the setting is written.",
  "id": "GHSA-vp3w-52v9-q57f",
  "modified": "2026-09-23T18:51:01Z",
  "published": "2026-09-23T18:51:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenC3/cosmos/pull/3489"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenC3/cosmos"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenC3/cosmos/releases/tag/v7.2.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-77601 (GCVE-0-2026-77601)

FKIE_CVE-2026-77601

GHSA-VP3W-52V9-Q57F

Summary

Details

PoC

Impact

Suggested fix

Tags

Sightings

Nomenclature

Related by attack behaviour