VulnSocial

CVE-2026-42086Disclosure(openc3 / cosmos)

LOWCVSS 4.6 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage. This issue has been patched in version 7.0.0.

openc3 CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • cosmos

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
openc3
Products
cosmos

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-05-04: 2Technical Details · 2026-05-04: 105-04
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets3 URLs
Full discourse2 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-42086 Cross-Site Scripting in OpenC3 COSMOS Command Sender UI Before 7.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42086 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3

    Post summary

    The tweet announces CVE‑2026‑42086, detailing a cross‑site scripting vulnerability in OpenC3 COSMOS Command Sender UI before version 7.0.0, and provides a link for more information.

    0000041
    4.0K followersView on X
  • CVE@CVEnew
    General

    CVE-2026-42086 OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sender UI … https://www.cve.org/CVERecord?id=CVE-2026-42086

    Post summary

    The statement references CVE‑2026‑42086 relating to OpenC3 COSMOS’s Command Sender UI before version 7.0.0 but provides no further exploitation, patch, or technical details.

    00000102
    57.4K followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
Appopenc3cosmos---
Appopenc3cosmos7.0.0--
Appopenc3cosmos7.0.0--
Appopenc3cosmos7.0.0--

Explore more

Back to dashboardopenc3 CVEscosmos vulnerabilities