CVE-2026-77601: OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

September 23, 2026

An authenticated user can execute arbitrary operating system commands on the openc3-cosmos-cmd-tlm-api service. The pypi_url setting is interpolated, unescaped, into a command line that is run through a shell backtick when a plugin is installed. Shell metacharacters in the setting value are executed by /bin/sh.

References

github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b
github.com/OpenC3/cosmos/pull/3489
github.com/OpenC3/cosmos/releases/tag/v7.2.1
github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f
github.com/advisories/GHSA-vp3w-52v9-q57f
nvd.nist.gov/vuln/detail/CVE-2026-77601

Code Behaviors & Features

Detect and mitigate CVE-2026-77601 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →