openc3
PyPI9 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting openc3page 1 of 1
- CVE-2024-43795MEDIUMCVSS 6.1EG 6.1✓ Fixed in 5.19.02024-10-02
vulnerable: 0.1.0 ... 5.9.2b0 (22 versions)
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a reflected cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 5…
- CVE-2024-46977MEDIUMCVSS 6.5EG 6.5✓ Fixed in 5.19.02024-10-02
vulnerable: 0.1.0 ... 5.9.2b0 (22 versions)
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's open_local_file method allows an authenticated user with adequate …
- CVE-2024-47529MEDIUMCVSS 6.5EG 6.5✓ Fixed in 5.19.02024-10-02
vulnerable: 0.1.0 ... 5.9.2b0 (22 versions)
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user passw…
- CVE-2025-28380MEDIUMCVSS 6.1EG 6.12025-06-13
vulnerable: 0.1.0 ... 6.0.0 (25 versions)
A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter.
- CVE-2025-28381HIGHCVSS 7.5EG 7.52025-06-13
vulnerable: 0.1.0 ... 6.0.0 (25 versions)
A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.
- CVE-2025-28386CRITICALCVSS 9.8EG 9.82025-06-13
vulnerable: 0.1.0 ... 6.0.0 (25 versions)
A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.
- CVE-2025-28388CRITICALCVSS 9.8EG 9.82025-06-13
vulnerable: 0.1.0 ... 6.0.0 (25 versions)
OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.
- CVE-2025-28389CRITICALCVSS 9.8EG 9.82025-06-13
vulnerable: 0.1.0 ... 6.0.0 (25 versions)
Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.
- CVE-2026-42086MEDIUMCVSS 4.6EG 4.6✓ Fixed in 7.0.02026-05-04
vulnerable: 0.1.0 ... 7.0.0rc3 (52 versions)
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sender UI uses an unsafe eval() function on array-like command parameters, which al…
Check whether openc3 is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for openc3 CVEs against the assets you own.
Start Free Scan →