CVE-2026-77394: OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

A user who can save a telemetry screen (permission system_set) can embed JavaScript in a screen BUTTON widget. The BUTTON widget eval()s the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope. As a result, an attacker’s stored JavaScript executes in a different operator’s authenticated session — a stored, cross-user XSS (not self-XSS). The payload runs in the COSMOS origin and can read localStorage.openc3Token (the victim’s session token), enabling session/account takeover and, via the victim’s privileges, a path to server-side code execution through the Script Runner.

The site’s Content-Security-Policy permits 'unsafe-inline'/'unsafe-eval' (see “Contributing factor”), so the injected script runs unimpeded.

• Product: OpenC3 COSMOS (Core; likely Enterprise — see scoping note)
• Affected version: confirmed 7.2.0 (latest, tested 2026-06-25); the code path is present on main. Lower bound for maintainer to confirm.
• Reporter: Arpit Kubadia