CVE-2025-68271: 
Ruby vulnerability analysis and mitigation

CVE-2025-68271 is a critical unauthenticated remote code execution (RCE) vulnerability in OpenC3 COSMOS, an open-source command and control platform for embedded systems. The flaw exists in the openc3-api component and is reachable through the JSON-RPC API without any authentication. It affects versions 5.0.6 through 6.10.1 (RubyGems package openc3) and was disclosed on January 13, 2026, with a fix released in version 6.10.2. It carries a CVSS v3.1 base score of 10.0 (Critical) (Github Advisory, OpenC3 Advisory).

The root cause is an eval injection flaw (CWE-95 / CWE-94) in the String#convert_to_value method within openc3/lib/openc3/core_ext/string.rb. When a JSON-RPC request uses the string form of certain APIs (e.g., the cmd code path), attacker-controlled parameter text is passed to convert_to_value; if the input matches the ARRAY_CHECK_REGEX pattern (i.e., looks like [...]), the method calls Ruby's eval() directly on the attacker-supplied string. Critically, the cmd code path parses and evaluates the command string before calling authorize(), meaning the Ruby code executes even though the API ultimately returns a 401 Unauthorized response. The fix (commit 01e9fbc) replaces the eval() call with YAML.safe_load() for array/object inputs, and similarly replaces Python's eval with ast.literal_eval (OpenC3 Commit, Github Advisory).

An unauthenticated remote attacker can execute arbitrary Ruby code on the server hosting OpenC3 COSMOS, resulting in complete system compromise. The impact spans all three security dimensions: high confidentiality impact (access to sensitive telemetry, command data, credentials, and configuration), high integrity impact (modification of system files, configurations, or spacecraft/embedded system commands), and high availability impact (service disruption or destruction). Given that OpenC3 COSMOS is used to command and control embedded systems and spacecraft, exploitation could extend beyond the server itself to affect connected hardware targets (Github Advisory, OpenC3 Advisory).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any network-accessible attacker. The EPSS score is approximately 0.395% (61st percentile), indicating a moderate near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by researcher GhostPowerShell (OpenC3 Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible OpenC3 COSMOS instances running versions 5.0.6–6.10.1 using tools like Shodan, Censys, or network scanning. Look for the openc3-cosmos-cmd-tlm-api service endpoint.
2. Identify the JSON-RPC API endpoint: Locate the JSON-RPC API endpoint (typically exposed by the openc3-cosmos-cmd-tlm-api service). No authentication token is required.
3. Craft a malicious JSON-RPC request: Construct a JSON-RPC request that uses the string form of the cmd API, embedding a Ruby eval-compatible array-like payload in the command parameter. For example, a parameter value matching [<ruby_code>] will trigger convert_to_value to call eval() on the attacker-controlled string.
4. Trigger pre-authorization code execution: Send the crafted request to the API. The server parses the command string (executing the embedded Ruby code) before reaching the authorize() check. The server returns HTTP 401, but the injected code has already executed.
5. Achieve objective: The executed Ruby code can establish a reverse shell, exfiltrate data, write files, or issue commands to connected embedded systems/targets (OpenC3 Advisory, OpenC3 Commit).

• Network: Unexpected HTTP POST requests to the OpenC3 JSON-RPC API endpoint containing array-like parameters (e.g., values matching [...]) in command strings; outbound connections from the COSMOS API server to unknown external IPs or ports (potential reverse shell activity).
• Logs: API access logs showing requests to the cmd JSON-RPC method that return HTTP 401 but are accompanied by unusual server-side activity; Ruby exception traces or unexpected output in openc3-cosmos-cmd-tlm-api container/service logs.
• File System: Unexpected new files, scripts, or web shells written to the COSMOS installation directory or container filesystem; new cron jobs or scheduled tasks created under the service account.
• Process: Unusual child processes spawned by the Ruby/COSMOS API process (e.g., bash, sh, curl, wget, nc, python) indicating command execution; unexpected network connections initiated by the API service process.

The vulnerability is fixed in OpenC3 COSMOS version 6.10.2 (RubyGems package openc3); organizations should upgrade immediately (Github Advisory, OpenC3 Advisory). As a temporary workaround prior to patching, implement network-level access controls (firewall rules, VPN, or network segmentation) to restrict access to the JSON-RPC API endpoints to trusted hosts and networks only. Additionally, monitor JSON-RPC API logs for suspicious parameter patterns (array-like strings in command parameters) as a detection measure while patching is in progress.

The vulnerability was published by OpenC3 maintainer ryanmelt on January 13, 2026, and credited to researcher GhostPowerShell (OpenC3 Advisory). A technical write-up was published by Infinit Security at infinitsec.net shortly after disclosure. The vulnerability received attention on Mastodon via TheHackerWire and was indexed by multiple vulnerability tracking platforms including VulnDB, CVEFeed, and CIRCL. Given the perfect CVSS score of 10.0 and the unauthenticated nature of the flaw, community reaction highlighted the severity, particularly for organizations using COSMOS in aerospace or embedded systems testing contexts.