Critical SQL Injection Vulnerability in OpenC3 Package: Telemetry Data Exposure and Deletion Risk
Summary
GHSA-v529-vhwc-wfc5: OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database. Affects openc3 versions >= 6.7.0, < 7.0.0-rc3. Fixed in 7.0.0-rc3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenC3 is an open-source software framework designed for managing and analyzing telemetry data. It utilizes a Time-Series Database (TSDB) component, specifically QuestDB, to store and retrieve time-series data efficiently. The framework is widely used in various applications that require real-time data processing and analytics. However, a critical vulnerability has been identified in the TSDB component, which exposes the system to SQL injection attacks, potentially allowing unauthorized access to sensitive telemetry data and the ability to delete it.
Vulnerability Detail
The vulnerability arises from the improper handling of user-supplied input in the tsdb_lookup function located in the cvt_model.rb file. This function directly incorporates user input into SQL queries without adequate sanitization, enabling attackers to manipulate the SQL commands executed by the database. The implications of this vulnerability are severe, as it allows authenticated users with minimal permissions to execute arbitrary SQL commands, leading to unauthorized data disclosure and deletion. The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').
How To Fix
Latest published version: 7.4.1 as of 22 Oct 2026
gem install openc3 -v 7.4.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.0-rc3
This is the first release that contains the fix.
gem install openc3 -v 7.0.0-rc3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the get_tlm_values RPC endpoint by modifying the roles and permissions defined in roles-permissions.md. Ensure that only trusted users have access to this endpoint until the package is updated.
Conclusion
The SQL injection vulnerability in the OpenC3 package poses a significant risk to users, allowing unauthorized access and potential deletion of telemetry data. It is crucial to update to the latest patched version and implement best practices for input sanitization to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for openc3 →
FAQ
SQL injection is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It occurs when user input is improperly sanitized, allowing malicious SQL code to be executed.
Any user with Admin, Operator, Viewer, or Runner roles in the OpenC3 framework can potentially exploit this vulnerability to access or delete telemetry data.
The consequences include unauthorized access to sensitive telemetry data, potential data loss through deletion, and overall compromise of the integrity of the database.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
If an immediate update is not possible, consider implementing strict access controls and monitoring for any suspicious activity related to the TSDB component until the vulnerability is patched.
References
Related vulnerabilities
Recent vulnerabilities recorded for openc3.
