CVE-2026-77601: OpenC3 Vulnerability Leading to Authenticated OS Command Injection
Summary
CVE-2026-77601: OpenC3 COSMOS: Authenticated OS command injection via the pypi_url setting. Affects openc3 versions >= 5.12.0, < 7.3.0. Fixed in 7.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenC3 is an open-source platform designed for managing and monitoring telemetry data in various applications. It provides a robust API for plugin management and allows users to customize functionalities through plugins. However, the platform has a significant vulnerability that permits authenticated users to execute arbitrary operating system commands, potentially compromising the entire system.
Vulnerability Detail
The vulnerability arises from the improper handling of the 'pypi_url' setting within the OpenC3 COSMOS service. When an authenticated user sets this URL, it is interpolated directly into a command line executed via a shell backtick. This allows attackers to inject shell metacharacters, leading to arbitrary command execution as the 'openc3' user. The flaw is exacerbated by insufficient authorization checks, enabling any authenticated user to exploit this vulnerability, particularly in the open-source edition of the software.
How To Fix
Latest published version: 7.4.1 as of 22 Oct 2026
gem install openc3 -v 7.4.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.3.0
This is the first release that contains the fix.
gem install openc3 -v 7.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that only trusted users have access to the OpenC3 platform, especially in the open-source edition. Additionally, avoid using the 'pypi_url' setting until the package is updated to a secure version.
Conclusion
CVE-2026-77601 represents a critical vulnerability in the OpenC3 platform that allows authenticated users to execute arbitrary commands, posing significant risks to system security. It is essential to update to the patched version and implement the recommended code changes to mitigate this risk.
See every vulnerability recorded for openc3 →
FAQ
CVE-2026-77601 is a vulnerability in the OpenC3 platform that allows authenticated users to execute arbitrary operating system commands through improper handling of the 'pypi_url' setting.
Any authenticated user of the OpenC3 platform, particularly in the open-source edition, can exploit this vulnerability.
Exploitation of this vulnerability can lead to arbitrary command execution, compromising sensitive data and system integrity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for openc3.
