CVE-2026-77394: OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with systemset permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenC3 COSMOSto a version that resolves this vulnerability.Fixed in 7.3.0
Event History
Frequently Asked Questions
Which users and deployments are exposed?
OpenC3 COSMOS versions from 5.0.6 up to, but not including, 7.3.0 are affected. Exploitation targets operators who use a shared Telemetry screen containing the malicious BUTTON widget and activate that button.
What access does an attacker need?
The attacker must be authenticated and have the system_set permission. They use that access to save a shared screen through the screen API with a crafted BUTTON widget action.
What is the impact if a victim activates a malicious button?
Script executes in the COSMOS origin in the victim's browser and can read localStorage.openc3Token. The token can be stolen to take over the victim's account and perform actions with that user's privileges.
What remediation is available?
Upgrade OpenC3 COSMOS to version 7.3.0, which fixes the issue. The data provided does not identify a workaround for installations that cannot yet upgrade.