{"cve":"CVE-2026-77601","nvd":{"published":"2026-09-23T19:19:18.380","modified":"2026-09-23T20:17:16.027","status":"Deferred","description":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 in openc3/lib/openc3/models/plugin_model.rb to interpolate the value into a shell command while installing a plugin with Python dependency metadata. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary operating-system commands to run as the openc3 service user with access to Redis and bucket credentials. Open-source deployments permit any authenticated user to reach the affected operations, while Enterprise deployments require an administrator. This issue is fixed in version 7.3.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-78"],"references":["https://github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b","https://github.com/OpenC3/cosmos/pull/3489","https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f","https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-77601","score":0.00628,"percentile":0.50119,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-vp3w-52v9-q57f","url":"https://osv.dev/vulnerability/GHSA-vp3w-52v9-q57f","summary":"OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting","modified":"2026-09-23T19:01:49.808194984Z","packages":[{"ecosystem":"RubyGems","name":"openc3","purl":"pkg:gem/openc3","ranges":[">=5.12.0 <7.3.0"],"fixed":["7.3.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}