CVE-2026-77394 OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
An authenticated user can inject malicious scripts into shared screens, stealing bearer tokens and taking over other operators' accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-77394?
CVE-2026-77394 is a high-severity cross-site scripting vulnerability in OpenC3 cosmos, published on 23 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-77394?
2 open source packages ship an affected version, including @openc3/vue-common.
| Package | Affected | Fixed in |
|---|---|---|
@openc3/vue-common npm | From 5.0.6 | 7.3.0 |
@openc3/vue-common npm | From 5.0.6 | 7.3.0 |
How do I fix CVE-2026-77394?
Upgrade @openc3/vue-common to 7.3.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-77394 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77394 exists.
Sources
Also known as GHSA-gvf2-2rh5-mpgf.