CVE-2026-77601
1 advisory.
RubyGems/openc3 CVE-2026-77601: high 8.8
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting
Action: Upgrade openc3 to 7.3.0 or later.
bundle update openc3Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.12.0 | 7.3.0 | - |
Fixed versions
| 7.3.0 |
Sources
- osv: GHSA-vp3w-52v9-q57f
- https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f
- https://github.com/OpenC3/cosmos/pull/3489
- https://github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b
- https://github.com/OpenC3/cosmos
- https://github.com/OpenC3/cosmos/releases/tag/v7.2.1
CVE-2026-77601 · published · modified · JSON