CVE-2026-42086 OpenC3 COSMOS: Self-XSS in the Command Sender
An attacker can execute arbitrary JavaScript in a victim's browser via self-XSS in the Command Sender, potentially stealing session tokens or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42086?
CVE-2026-42086 is a medium-severity cross-site scripting vulnerability in OpenC3 cosmos, published on 4 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage. This issue has been patched in version 7.0.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-42086?
5 open source packages ship an affected version, including openc3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openc3 PyPI | All versions | 7.0.0 |
openc3 PyPI | All versions | 7.0.0 |
openc3 PyPI | All versions | 7.0.0 |
openc3 RubyGems | All versions | 7.0.0 |
openc3 RubyGems | All versions | 7.0.0 |
Products include Openc3 Cosmos.
How do I fix CVE-2026-42086?
Upgrade openc3 to 7.0.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-42086 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42086 exists.
Other vulnerabilities in OpenC3 cosmos
Sources
Also known as GHSA-ffq5-qpvf-xq7x, PYSEC-2026-105.