CVE-2026-77394: OpenC3 COSMOS Stored XSS Vulnerability

CVE-2026-77394 Overview

OpenC3 COSMOS is an open-source command and control platform for embedded systems. CVE-2026-77394 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting versions 5.0.6 through 7.2.x. An authenticated user with system_set permission can save a shared screen via POST /openc3-api/screen containing a malicious BUTTON widget action. When another operator activates the button in their browser session, the injected script executes in the COSMOS origin. The vulnerability is fixed in version 7.3.0.

Critical Impact
Injected scripts can read localStorage.openc3Token, enabling bearer token theft, account takeover, and privileged actions performed as the victim operator.

Affected Products

OpenC3 COSMOS versions 5.0.6 through 7.2.x
openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue component
Shared screen storage feature accessible to system_set role holders

Discovery Timeline

2026-09-23 - CVE-2026-77394 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77394

Vulnerability Analysis

The vulnerability resides in the ButtonWidget.vue component of the OpenC3 COSMOS Vue.js front end. Shared screens accept a BUTTON widget whose action string is evaluated dynamically when an operator clicks the button. Because the action is stored server-side through POST /openc3-api/screen, any authenticated actor with system_set permission can persist attacker-controlled JavaScript. That code later runs inside the browser session of any operator who opens the affected screen and activates the button.

Execution occurs in the COSMOS origin, giving the payload full access to same-origin storage. The COSMOS bearer token stored in localStorage.openc3Token is retrievable and can be exfiltrated to an attacker-controlled endpoint. With the stolen token, an attacker can impersonate the victim, execute commands against connected embedded systems, and pivot toward higher-privilege accounts.

Root Cause

The root cause is unsafe evaluation of a stored, user-controlled string as JavaScript inside ButtonWidget.vue. The application performs no sanitization or sandboxing on the button action before invoking it in the operator's browser context. A permissive Content Security Policy (CSP) that allowed unsafe-inline script execution amplified the impact but was not the primary flaw.

Attack Vector

Exploitation requires an authenticated account with the system_set permission and user interaction from a second operator. The attacker submits a crafted screen definition through the screen API. When a victim loads the screen and clicks the malicious button, the payload runs, reads localStorage.openc3Token, and sends it to an attacker-controlled server.

javascript

// Patch reference: buttonScriptSandbox introduced in v7.3.0
// openc3-cosmos-init/plugins/packages/openc3-vue-common/src/util/index.js
export { runButtonScript } from './buttonScriptSandbox'

Source: GitHub Commit 10371f8

The fix also externalizes the SystemJS import map so the CSP script-src directive no longer requires unsafe-inline, hardening the origin against future injection attempts.

Detection Methods for CVE-2026-77394

Indicators of Compromise

Unexpected POST /openc3-api/screen requests originating from accounts holding system_set permission that were not previously authoring screens.
Outbound browser requests from COSMOS operator sessions to unfamiliar external domains shortly after a screen is opened.
Stored screen definitions containing BUTTON widget actions that reference localStorage, fetch, XMLHttpRequest, or document.cookie.
Repeated API calls using the same bearer token from multiple source IP addresses, indicating token replay.

Detection Strategies

Audit all persisted screen definitions for BUTTON widget actions that invoke network or storage APIs.
Correlate system_set role activity with screen creation and modification events in the COSMOS audit trail.
Alert on any front-end script attempting to access openc3Token from localStorage outside of authentication flows.

Monitoring Recommendations

Enable verbose logging on the /openc3-api/screen endpoint and forward the logs to a centralized SIEM.
Monitor for bearer token reuse across disparate geolocations or user agents.
Track browser Content Security Policy violation reports emitted from operator workstations.

How to Mitigate CVE-2026-77394

Immediate Actions Required

Upgrade OpenC3 COSMOS to version 7.3.0 or later without delay.
Rotate all COSMOS bearer tokens and force re-authentication for operators after upgrading.
Review and remove any suspicious stored screen definitions authored during the vulnerable window.
Restrict system_set permission to a minimal set of trusted administrators.

Patch Information

The fix is delivered in OpenC3 COSMOS v7.3.0 via Pull Request #3560 and commit 10371f8. The patch introduces a runButtonScript sandbox for BUTTON widget actions and tightens the Content Security Policy by externalizing the SystemJS import map. Full technical details are available in the GHSA-gvf2-2rh5-mpgf advisory.

Workarounds

If immediate patching is not possible, revoke system_set permission from all non-administrative accounts.
Audit and delete existing shared screens that were created or modified by non-trusted users.
Deploy a stricter Content Security Policy that disallows unsafe-eval and unsafe-inline for scripts served by COSMOS.

bash

# Upgrade COSMOS to the patched release
git fetch --tags
git checkout v7.3.0
docker compose pull
docker compose up -d