Security
فارسی
All products

openc3

RubyGems · Package
11 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)CVE-2026-77602 · GHSA-JJQ7-M736-W977 openc3 RubyGems Critical Fix reported
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` settingCVE-2026-77601 · GHSA-VP3W-52V9-Q57F openc3 RubyGems High Fix reported
OpenC3 COSMOS: Hijacked session token can be used to reset password for persistenceCVE-2026-42084 · GHSA-WGX6-G857-JJF7 openc3openc3 PyPIRubyGems High Fix reported
OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed config filenamesCVE-2026-42085 · GHSA-4JVX-93H3-F45H openc3openc3 PyPIRubyGems Medium Fix reported
OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner ToolCVE-2026-42088 · GHSA-2WVH-87G2-89HR openc3openc3 PyPIRubyGems Critical Fix reported
OpenC3 COSMOS has SQL Injection in QuestDB Time-Series DatabaseCVE-2026-42087 · GHSA-V529-VHWC-WFC5 openc3openc3 PyPIRubyGems Critical Fix reported
OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command SenderCVE-2026-42086 · GHSA-FFQ5-QPVF-XQ7XVersion ranges need review. openc3openc3 PyPIRubyGems Medium Fix reported
openc3-api Vulnerable to Unauthenticated Remote Code ExecutionCVE-2025-68271 · GHSA-W757-4QV9-MGHP openc3 RubyGems Critical Fix reported
OpenC3 stores passwords in clear text (`GHSL-2024-129`)CVE-2024-47529 · GHSA-4XQV-47RM-37MMVersion ranges need review. @openc3/tool-commonopenc3 npmPyPIRubyGems Medium Fix reported
OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)CVE-2024-43795 · GHSA-VFJ8-5PJ7-2F9GVersion ranges need review. @openc3/tool-commonopenc3 npmPyPIRubyGems Medium Fix reported
OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)CVE-2024-46977 · GHSA-8JXR-MCCC-MWG8Version ranges need review. openc3openc3 PyPIRubyGems High Fix reported