CVE-2026-77601: OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

September 23, 2026

An authenticated user can execute arbitrary operating system commands on the openc3-cosmos-cmd-tlm-api service. The pypi_url setting is interpolated, unescaped, into a command line that is run through a shell backtick when a plugin is installed. Shell metacharacters in the setting value are executed by /bin/sh.

References

github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b
github.com/OpenC3/cosmos/pull/3489
github.com/OpenC3/cosmos/releases/tag/v7.2.1
github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f
github.com/advisories/GHSA-vp3w-52v9-q57f
nvd.nist.gov/vuln/detail/CVE-2026-77601

Code Behaviors & Features

Detect and mitigate CVE-2026-77601 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →