What is the CVSS score of CVE-2026-42086?

CVE-2026-42086 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42086?

Yes, a patch is available for CVE-2026-42086. Update the affected software to the latest version immediately.

OpenC3 COSMOS CVE-2026-42086

EUVD-2026-27061 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-04 GitHub_M

XSS Cosmos

4.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.6 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 04, 2026 - 19:17 EUVD

Source Code Evidence Fetched

May 04, 2026 - 18:03 vuln.today

Analysis Generated

May 04, 2026 - 18:03 vuln.today

Analysis Generated

May 04, 2026 - 17:45 vuln.today

CVE Published

May 04, 2026 - 17:15 nvd

MEDIUM 4.6

DescriptionGitHub Advisory

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage. This issue has been patched in version 7.0.0.

AnalysisAI

Self-XSS in OpenC3 COSMOS Command Sender UI prior to version 7.0.0 allows authenticated users to execute arbitrary JavaScript in their own browser session via unsafe eval() processing of array parameters. An attacker can exploit this through phishing or by convincing a victim to send a malicious command, potentially stealing session tokens or modifying authenticated data. Patch available in version 7.0.0.

Technical ContextAI

OpenC3 COSMOS is an embedded systems command and telemetry tool. The vulnerability exists in the CommandSender.vue component's convertToValue() method, which uses JavaScript's eval() function to parse array-like command parameters without sanitization. When a user inputs an array parameter (enclosed in square brackets) in the Command Sender UI, the eval() function interprets the entire string as executable code rather than data, allowing arbitrary JavaScript injection. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the dangerous use of eval() on user-controlled input combined with insufficient output encoding.

RemediationAI

Upgrade OpenC3 COSMOS to version 7.0.0 or later immediately - this is the vendor-released patch that fixes the unsafe eval() usage in the Command Sender UI. For organizations unable to upgrade immediately, implement network access controls to restrict who can reach the COSMOS Command Sender UI (e.g., firewall rules limiting access to trusted networks or bastion hosts), and educate users not to send commands with untrusted input in array parameters. Additionally, review browser local storage policies and consider using session management tools that automatically invalidate or rotate session tokens on suspicious activity. However, these controls do not eliminate the vulnerability - upgrading to 7.0.0 is the definitive remediation. Reference the GHSA advisory at https://github.com/OpenC3/cosmos/security/advisories/GHSA-ffq5-qpvf-xq7x for confirmation and additional details.