{"action":"Upgrade @openc3/vue-common to 7.3.0 or later.","affected":[{"fixed":"7.3.0","introduced":"5.0.6"}],"component":"@openc3/vue-common","cve_ids":["CVE-2026-77394"],"ecosystem":"npm","epss":0.0039,"exploited":false,"fixed_versions":["7.3.0"],"ghsa_id":"GHSA-gvf2-2rh5-mpgf","id":"tcs_01M5KFSJBVSW4H9QMJX6HNFT4Q","modified_at":"2026-09-23T21:45:07.938130889Z","published_at":"2026-09-23T21:24:11Z","references":["https://osv.dev/vulnerability/GHSA-gvf2-2rh5-mpgf","https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf","https://github.com/OpenC3/cosmos/pull/3560","https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3","https://github.com/OpenC3/cosmos","https://github.com/OpenC3/cosmos/releases/tag/v7.3.0"],"severity":{"label":"high","score":7.6},"sources":[{"source":"osv","source_id":"GHSA-gvf2-2rh5-mpgf","url":"https://osv.dev/vulnerability/GHSA-gvf2-2rh5-mpgf"}],"summary":"OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget"}