RubyGems/openc3 CVE-2026-77601: high 8.8, EPSS 0.63%

OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

Action: Upgrade openc3 to 7.3.0 or later.

bundle update openc3

Affected

Fixed versions

Sources

• osv: GHSA-vp3w-52v9-q57f
• https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f
• https://github.com/OpenC3/cosmos/pull/3489
• https://github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b
• https://github.com/OpenC3/cosmos
• https://github.com/OpenC3/cosmos/releases/tag/v7.2.1

CVE-2026-77601 · published 2026-09-23T18:51:01Z · modified 2026-09-23T19:01:49.808194984Z · JSON