OpenC3 COSMOS CVE-2026-77394

Requires an authenticated account holding the system_set permission to store the malicious shared screen via POST /openc3-api/screen (PR:L), AND a separate victim operator must open that shared screen and activate the BUTTON widget for the stored action to be evaluated by ButtonWidget.vue (UI:R). Affected only in OpenC3 COSMOS versions 5.0.6 up to but not including 7.3.0. Exploitation is aided by the permissive default content security policy, which permitted inline script execution; the 7.3.0 fix both sanitizes the button action and removes 'unsafe-inline' from script-src. The dependence on a pre-existing privileged account plus a privileged victim's click meaningfully limits realistic exploitation.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N = 7.6 High) describes a network-exploitable stored XSS requiring low privileges (an authenticated actor holding the system_set permission) plus victim user interaction (a second operator clicking the malicious BUTTON widget). The scope change (S:C) and C:H are justified because the injected script executes in the COSMOS origin and steals localStorage.openc3Token, crossing from the attacker's authorization context into the victim operator's session, yielding token theft and account takeover. No EPSS score, KEV listing, or public POC is provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is real but conditional rather than mass-exploitable. This is a legitimate priority for the specific population that runs COSMOS ground-station consoles, but the twin gating factors (attacker must already hold system_set, and a privileged victim must activate the malicious button) plus the niche deployment footprint keep real-world blast radius narrow. The permissive content security policy is noted by the vendor as a contributing (not root-cause) factor; the fix both sanitizes the sink and hardens CSP by removing 'unsafe-inline' (externalizing the import map and bootstrap script).

An authenticated user with system_set permission uses POST /openc3-api/screen to store a shared screen whose BUTTON widget action contains a malicious script payload. A second, higher-privileged operator later opens that shared screen and clicks the button; ButtonWidget.vue evaluates the action in that operator's browser, the script reads localStorage.openc3Token, and the attacker exfiltrates the bearer token to take over the victim's account and act with their privileges. No public POC is referenced, though the vendor advisory (GHSA-gvf2-2rh5-mpgf) and fixing PR #3560 document the mechanism precisely.