CVE-2026-77602

RubyGems/openc3 CVE-2026-77602: critical 9.9, EPSS 0.57%

OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

Action: Upgrade openc3 to 7.3.0 or later.

bundle update openc3

Affected

Fixed versions

Sources

• osv: GHSA-jjq7-m736-w977
• https://github.com/OpenC3/cosmos/security/advisories/GHSA-jjq7-m736-w977
• https://github.com/OpenC3/cosmos/pull/3488
• https://github.com/OpenC3/cosmos/commit/71943352a28128ef3e7e894319d97a656b5cd4f2
• https://github.com/OpenC3/cosmos/commit/7a1538a4626f82c0d1540fcaa27ffdcbbd71ff81
• https://github.com/OpenC3/cosmos

CVE-2026-77602 · published 2026-09-23T18:57:24Z · modified 2026-09-23T19:01:49.808466306Z · JSON