CVE-2026-77602: OpenC3 Arbitrary Code Execution via User-Writable Config Overlay
Summary
CVE-2026-77602: COSMOS reads configuration from a user-writable overlay (targets_modified/) before the read-only plugin-installed targets/ tree, and the config subsystem executes code on those files: ConfigParser renders every file as E... Affects openc3 versions >= 5.1.0, < 7.3.0. Fixed in 7.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenC3 is an open-source framework designed for managing and analyzing command and telemetry data in various applications. It allows users to define targets, manage configurations, and execute scripts for data processing. However, due to its architecture, it has a vulnerability that allows authenticated users to execute arbitrary code through user-writable configuration files, compromising the security of the system.
Vulnerability Detail
The vulnerability arises from the way OpenC3 handles configuration files in the user-writable overlay directory. Authenticated users can write files that are processed as code, leading to arbitrary code execution. This is facilitated by the ConfigParser, which renders files as ERB (Embedded Ruby) by default, and the GenericConversion mechanism that evaluates code blocks. The vulnerability can be exploited through multiple routes, including table definitions, command/telemetry definitions, and script runner suites, allowing attackers to execute malicious code with the privileges of the OpenC3 user.
How To Fix
Latest published version: 7.4.1 as of 22 Oct 2026
gem install openc3 -v 7.4.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.3.0
This is the first release that contains the fix.
gem install openc3 -v 7.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable ERB rendering in the configuration parser by setting 'run_erb=false' when loading configuration files. This will prevent the execution of any embedded Ruby code in the configuration files.
Conclusion
CVE-2026-77602 represents a significant security risk for OpenC3 users, allowing for arbitrary code execution through mismanaged configuration files. It is crucial to update to the patched version and implement recommended security practices to mitigate this vulnerability.
See every vulnerability recorded for openc3 →
FAQ
CVE-2026-77602 is a critical vulnerability in OpenC3 that allows authenticated users to execute arbitrary code through user-writable configuration files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 9.9, indicating a critical level of severity.
If you cannot update the package immediately, consider implementing the workaround by disabling ERB rendering in the configuration parser.
The vulnerability can lead to arbitrary code execution, allowing attackers to gain control over the OpenC3 server and access sensitive data and configurations.
References
Related vulnerabilities
Recent vulnerabilities recorded for openc3.
