https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 03:37:29 +0000 https://vulnerability.circl.lu/vuln/cve-2026-77394 <p><strong>Affected:</strong> OpenC3 cosmos</p> <p>OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator&#39;s browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim&#39;s bearer token, account takeover, and actions with the victim&#39;s privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0.</p> <p><strong>Affected:</strong> OpenC3 cosmos</p> <p>OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator&#39;s browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim&#39;s bearer token, account takeover, and actions with the victim&#39;s privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-77394