cveboard RSS feed

CVE-2026-77602

GitHubCritical, rubygems

OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

COSMOS reads configuration from a user-writable overlay (targets_modified/) before the read-only plugin-installed targets/ tree, and the config subsystem executes code on those files: ConfigParser renders every file as ERB by default, a GENERIC_READ_CONVERSION / GENERIC_WRITE_CONVERSION block is evaluated as code by GenericConversion (Ruby and Python), and the Script Runner suite analysis…

No known exploitation
Severity
Critical, CVSS 9.9 (v3.1)
EPSS
0.57% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
Affected packages