CVE-2026-77601 in COSMOS
Summary
by MITRE • 09/23/2026
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 in openc3/lib/openc3/models/plugin_model.rb to interpolate the value into a shell command while installing a plugin with Python dependency metadata. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary operating-system commands to run as the openc3 service user with access to Redis and bucket credentials. Open-source deployments permit any authenticated user to reach the affected operations, while Enterprise deployments require an administrator. This issue is fixed in version 7.3.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
OpenC3 COSMOS serves as a critical framework for managing interactions between software systems and embedded hardware, facilitating command execution and data retrieval across distributed environments. Within the versions spanning from 5.12.0 to 7.3.0, a significant security flaw exists in how configuration settings are processed during plugin installation procedures. The vulnerability centers on the set_setting endpoint exposed via POST /openc3-api/api, which allows authenticated users to modify internal system configurations. Specifically, this includes the pypi_url setting, which dictates the source for Python package dependencies when installing plugins that require such metadata.
The core technical flaw lies in improper neutralization of special elements used in shell commands, commonly classified under CWE-78 Improper Neutralization of Special Elements used in an OS Command or Insecure Temporary File if file operations are involved, though here it is strictly command injection. When the OpenC3::PluginModel.install_phase2 method processes a plugin with Python dependencies, it constructs a system call to interact with pip or similar package managers. The value provided for pypi_url is interpolated directly into this shell command without adequate sanitization or validation of metacharacters. Consequently, an attacker can inject arbitrary operating-system commands by embedding shell syntax within the URL string.
This vulnerability enables remote code execution under the context of the openc3 service user. The operational impact is severe because this service account typically holds elevated privileges necessary to interact with backend infrastructure components such as Redis and access bucket credentials for data storage. In open-source deployments, any authenticated user can exploit this flaw due to the permissive nature of default configurations. In Enterprise editions, exploitation requires administrator-level authentication, which limits the attack surface but increases the potential damage if an admin account is compromised. The ability to execute arbitrary commands allows attackers to pivot further into the network, exfiltrate sensitive data stored in Redis or buckets, and potentially gain control over other systems connected to the COSMOS infrastructure.
Mitigation strategies primarily involve upgrading to version 7.3.0 where this issue has been resolved through proper input validation and safe command execution practices. For environments that cannot immediately upgrade, restricting access to the set_setting API endpoint is crucial. Implementing strict role-based access control ensures that only trusted administrators can modify critical configuration settings like pypi_url. Additionally, validating all user-supplied inputs against a whitelist of allowed characters or domains before processing them in system calls can prevent shell metacharacter injection. Monitoring logs for unusual patterns in plugin installation requests may also aid in detecting attempted exploitation activities. This vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter, highlighting the risk associated with unsafe command construction in application logic.