CVE-2026-77394: OpenC3 COSMOS Stored Cross-User XSS via Telemetry Screen BUTTON Widget
Summary
CVE-2026-77394: OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget. Affects @openc3/vue-common versions >= 5.0.6, < 7.3.0. Fixed in 7.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenC3 COSMOS is a telemetry management platform that allows users to create and manage screens for monitoring various operational metrics. It provides a user-friendly interface for visualizing data and includes features for sharing screens among users. However, the platform has a critical vulnerability that allows users with specific permissions to embed malicious JavaScript in shared screens, leading to severe security risks.
Vulnerability Detail
The vulnerability arises from the ability of users with the 'system_set' permission to save telemetry screens without proper sanitization. When a BUTTON widget is activated, it executes the stored button text using eval(), allowing an attacker to inject JavaScript that runs in another user's authenticated session. This results in stored, cross-user XSS, enabling session token theft and potential account takeover. The vulnerability is exacerbated by the site's Content-Security-Policy, which permits unsafe inline scripts and eval(), allowing the injected code to execute without restriction.
How To Fix
Minimum fixed version
7.3.0
This is the first release that contains the fix.
npm install @openc3/vue-common@7.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the BUTTON widget for critical operations until the package is updated. Additionally, consider implementing stricter access controls to limit who can save telemetry screens.
Conclusion
CVE-2026-77394 is a critical vulnerability in OpenC3 COSMOS that allows for stored cross-user XSS through the BUTTON widget. Users are advised to update the affected package and tighten their Content-Security-Policy to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for @openc3/vue-common →
FAQ
The vulnerability allows attackers to execute arbitrary JavaScript in the context of another user's session, potentially leading to session hijacking and unauthorized access to sensitive information.
Any user with the 'system_set' permission in OpenC3 COSMOS is at risk, as they can save screens that may contain malicious code.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your package-lock.json file, you can receive real-time alerts about vulnerabilities, including CVE-2026-77394.
If an immediate update is not possible, implement stricter access controls and avoid using the BUTTON widget for critical operations until the vulnerability is patched.
The CVSS score for this vulnerability is 7.6, indicating a high severity level.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
