Skip to content

Commit de1759e

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@17e33a5 
1 parent b856901 commit de1759e

5 files changed

Lines changed: 248 additions & 0 deletions

File tree

‎advisories/_posts/2026-04-22-CVE-2026-42084.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-42084 (openc3): OpenC3 COSMOS - Hijacked session token can be used
4+
to reset password for persistence'
5+
comments: false
6+
categories:
7+
- openc3
8+
advisory:
9+
gem: openc3
10+
cve: 2026-42084
11+
ghsa: wgx6-g857-jjf7
12+
url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7
13+
title: OpenC3 COSMOS - Hijacked session token can be used to reset password for
14+
persistence
15+
date: 2026-04-22
16+
description: |-
17+
### Summary
18+
19+
The OpenC3 password change functionality allows a user to change their
20+
password without providing the old password, by accepting a valid
21+
session token instead. In assumed breach scenarios, this behaviour
22+
can be exploited by an attacker who has already obtained a valid
23+
session token, to gain persistence in hijacked account (including
24+
admin) and prevent legitimate users from accessing the account.
25+
26+
### Details
27+
28+
The design flaw in authentication model ([authentication.rb](https://github.com/OpenC3/cosmos/blob/397abec0d57972881a2e8dc10902d0dce9c27f42/openc3/lib/openc3/utilities/authentication.rb))
29+
allows for interchangeable use of password and session tokens for
30+
user authentication As old tokens are not revoked upon password
31+
reset, an attacker who has obtained a valid session token can
32+
continue to authenticate and change the account’s password even
33+
after the victim resets it, thereby maintaining persistent control
34+
over the compromised account.
35+
36+
### Impact
37+
38+
Persistence of an attacker who obtained valid session token and
39+
preventing legitimate users from account access.
40+
cvss_v3: 8.1
41+
patched_versions:
42+
- "~> 6.10.5"
43+
- ">= 7.0.0-rc3"
44+
related:
45+
url:
46+
- https://nvd.nist.gov/vuln/detail/CVE-2026-42084
47+
- https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7
48+
- https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
49+
- https://github.com/OpenC3/cosmos/releases/tag/v6.10.5
50+
- https://github.com/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776
51+
- https://github.com/advisories/GHSA-wgx6-g857-jjf7
52+
---

‎advisories/_posts/2026-04-22-CVE-2026-42085.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-42085 (openc3): OpenC3 COSMOS allows arbitrary writes to plugins
4+
directory via path-traversed config filenames'
5+
comments: false
6+
categories:
7+
- openc3
8+
advisory:
9+
gem: openc3
10+
cve: 2026-42085
11+
ghsa: 4jvx-93h3-f45h
12+
url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h
13+
title: OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed
14+
config filenames
15+
date: 2026-04-22
16+
description: |-
17+
### Summary
18+
19+
OpenC3 COSMOS contains a design flaw in the `save_tool_config()`
20+
function that allows saving tool configuration files at arbitrary
21+
locations inside the shared `/plugins` directory tree by supplying
22+
crafted configuration filenames. Although the implementation
23+
sufficiently mitigates standard path traversal attacks, by
24+
canonicalizing filename to an absolute path, all plugins share this
25+
same root directory. That enables users to create arbitrary file
26+
structures and overwrite existing configuration files within the
27+
shared `/plugins` directory.
28+
29+
### Details
30+
31+
In function `save_tool_config()` ([local_mode.rb](https://github.com/OpenC3/cosmos/blob/397abec0d57972881a2e8dc10902d0dce9c27f42/openc3/lib/openc3/utilities/local_mode.rb#L452))
32+
responsible for saving user-supplied tool configuration, the desired
33+
saving directory is not sufficiently enforced, instead allowing
34+
writes inside entire `OPENC3_LOCAL_MODE_PATH`.
35+
36+
### Impact
37+
38+
Modifying the data of other plugins.
39+
cvss_v3: 4.3
40+
patched_versions:
41+
- "~> 6.10.5"
42+
- ">= 7.0.0-rc3"
43+
related:
44+
url:
45+
- https://nvd.nist.gov/vuln/detail/CVE-2026-42085
46+
- https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h
47+
- https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
48+
- https://github.com/OpenC3/cosmos/releases/tag/v6.10.5
49+
- https://github.com/OpenC3/cosmos/commit/9957a9fa460c0c0cf5cdbf6a5931bbdd025246a5
50+
- https://github.com/OpenC3/cosmos/commit/e6efccbd148ba0e3361c5891027f2373aa140d42
51+
- https://github.com/advisories/GHSA-4jvx-93h3-f45h
52+
---

‎advisories/_posts/2026-04-22-CVE-2026-42086.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-42086 (openc3): OpenC3 COSMOS is Vulnerable to Self-XSS Through the
4+
Command Sender'
5+
comments: false
6+
categories:
7+
- openc3
8+
advisory:
9+
gem: openc3
10+
cve: 2026-42086
11+
ghsa: ffq5-qpvf-xq7x
12+
url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-ffq5-qpvf-xq7x
13+
title: OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender
14+
date: 2026-04-22
15+
description: |-
16+
### Summary
17+
18+
The Command Sender UI uses an unsafe `eval()` function on array-like
19+
command parameters, which allows a user-supplied payload to execute
20+
in the browser when sending a command. This creates a self-XSS risk
21+
because an attacker can trigger their own script execution in the
22+
victim’s session, if allowed to influence the array parameter input,
23+
for example via phishing. If successful, an attacker may read or
24+
modify data in the authenticated browser context, including session
25+
tokens in local storage.
26+
27+
### Details
28+
29+
The unsafe `eval()` usage on user-supplied ARRAY parameters happens
30+
in `convertToValue` method in [CommandSender.vue](https://github.com/OpenC3/cosmos/blob/main/openc3-cosmos-init/plugins/packages/openc3-cosmos-tool-cmdsender/src/tools/CommandSender/CommandSender.vue)
31+
32+
### Impact
33+
34+
Local JavaScript execution in the user's browser.
35+
cvss_v3: 4.6
36+
patched_versions:
37+
- ">= 7.0.0"
38+
related:
39+
url:
40+
- https://nvd.nist.gov/vuln/detail/CVE-2026-42086
41+
- https://github.com/OpenC3/cosmos/security/advisories/GHSA-ffq5-qpvf-xq7x
42+
- https://github.com/advisories/GHSA-ffq5-qpvf-xq7x
43+
---

‎advisories/_posts/2026-04-23-CVE-2026-42087.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-42087 (openc3): OpenC3 COSMOS has SQL Injection in QuestDB Time-Series
4+
Database'
5+
comments: false
6+
categories:
7+
- openc3
8+
advisory:
9+
gem: openc3
10+
cve: 2026-42087
11+
ghsa: v529-vhwc-wfc5
12+
url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5
13+
title: OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database
14+
date: 2026-04-23
15+
description: |-
16+
Vulnerability Type: CWE-89: Improper Neutralization of Special Elements
17+
used in an SQL Command ('SQL Injection')
18+
19+
Attack type: Authenticated remote
20+
21+
Impact: Telemetry data disclosure and deletion
22+
23+
Affected components: openc3-tsdb (QuestDB)
24+
25+
A SQL injection vulnerability exists in the Time-Series Database (TSDB)
26+
component of COSMOS. The `tsdb_lookup` function in the `cvt_model.rb`
27+
file directly places user-supplied input into a SQL query without
28+
sanitizing the input. As a result, a user can break out of the initial
29+
SQL statement and execute arbitrary SQL commands, including deleting data.
30+
31+
## Recommendations
32+
33+
* Sanitize all user-supplied input before executing it.
34+
* Use prepared statements with parameterized queries when
35+
executing SQL statements.
36+
cvss_v3: 9.6
37+
unaffected_versions:
38+
- "< 6.7.0"
39+
patched_versions:
40+
- ">= 7.0.0"
41+
related:
42+
url:
43+
- https://nvd.nist.gov/vuln/detail/CVE-2026-42087
44+
- https://rubygems.org/gems/openc3/versions/7.0.0
45+
- https://github.com/OpenC3/cosmos/releases/tag/v7.0.0
46+
- https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5
47+
- https://github.com/OpenC3/cosmos/commit/9ba60c09c8836a37a2e4ea67ab35fe403e041415
48+
- https://github.com/advisories/GHSA-v529-vhwc-wfc5
49+
---

‎advisories/_posts/2026-04-23-GHSA-2wvh-87g2-89hr.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-2wvh-87g2-89hr (openc3): OpenC3 COSMOS - Permissions Bypass Provides
4+
User Access to Unassigned Administrative Actions via Script Runner Tool'
5+
comments: false
6+
categories:
7+
- openc3
8+
advisory:
9+
gem: openc3
10+
ghsa: 2wvh-87g2-89hr
11+
url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-2wvh-87g2-89hr
12+
title: OpenC3 COSMOS - Permissions Bypass Provides User Access to Unassigned Administrative
13+
Actions via Script Runner Tool
14+
date: 2026-04-23
15+
description: |-
16+
Vulnerability Type: Execution with Unnecessary Privileges Attack
17+
type: Authenticated remote
18+
19+
Impact: Data disclosure/manipulation, privilege escalation
20+
21+
Affected components:
22+
23+
* The following docker images: Openc3inc/openc3-COSMOS-script-runner-api
24+
25+
The Script Runner widget allows users to execute Python and Ruby
26+
scripts directly from the openc3-COSMOS-script-runner-api container.
27+
Because all the docker containers share a network, users can execute
28+
specially crafted scripts to bypass the API permissions check and
29+
perform administrative actions, including reading and modifying data
30+
inside the Redis database, which can be used to read secrets and
31+
change COSMOS settings, as well as read and write to the buckets
32+
service, which holds configuration, log,and plugin files. These
33+
actions are normally only available from the Admin Console or with
34+
administrative privileges. Any user with permission to create and
35+
run scripts can connect to any service in the docker network.
36+
37+
## Recommendations
38+
39+
* Limit the permissions of the script runner API to prevent lower
40+
level users from performing administrative actions.
41+
cvss_v3: 9.6
42+
patched_versions:
43+
- ">= 7.0.0"
44+
related:
45+
url:
46+
- https://github.com/OpenC3/cosmos/security/advisories/GHSA-2wvh-87g2-89hr
47+
- https://rubygems.org/gems/openc3/versions/7.0.0
48+
- https://github.com/OpenC3/cosmos/releases/tag/v7.0.0
49+
- https://www.linkedin.com/posts/vulert_critical-permissions-bypass-in-openc3-cosmos-activity-7453420840760774656-RMv1
50+
- https://www.miggo.io/vulnerability-database/cve/GHSA-2wvh-87g2-89hr
51+
- https://github.com/advisories/GHSA-2wvh-87g2-89hr
52+
---

0 commit comments

Comments
 (0)