CVE-2026-42086: 
Python vulnerability analysis and mitigation

CVE-2026-42086 is a self-XSS vulnerability in the OpenC3 COSMOS Command Sender UI caused by the use of an unsafe eval() function on array-like command parameters. It affects all OpenC3 COSMOS open-source versions prior to 7.0.0, including release candidates rc1, rc2, and rc3. The vulnerability was published on April 20, 2026, by maintainer ryanmelt and assigned CVE-2026-42086. It carries a CVSS v3.1 base score of 4.6 (Medium) (GitHub Advisory).

The root cause is improper neutralization of user-controlled input before it is evaluated in the browser (CWE-79). Specifically, the convertToValue method in CommandSender.vue passes user-supplied ARRAY parameter values directly into JavaScript's eval() function without sanitization, enabling arbitrary script execution in the browser context. An attacker must be authenticated and able to influence the array parameter input — for example, by crafting a malicious command payload and convincing a victim to send it via phishing. The advisory includes a concrete PoC using the INST ARYCMD command with a payload such as alert("XSS") placed inside square brackets (GitHub Advisory).

Successful exploitation allows arbitrary JavaScript to execute within the authenticated victim's browser session. An attacker can read or modify data in the authenticated browser context, including session tokens stored in local storage, potentially enabling session hijacking or unauthorized actions within the COSMOS platform. Availability is not impacted, but both confidentiality and integrity of the browser session are at limited risk (GitHub Advisory).

A proof-of-concept exploit with numbered reproduction steps is publicly available in the GitHub Security Advisory, demonstrating how to trigger XSS via the Command Sender UI. Exploitation requires an authenticated user with low privileges and user interaction (e.g., a phishing scenario to influence the array parameter). There is no evidence of in-the-wild exploitation at this time, no threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.033%, reflecting low probability of automated exploitation (GitHub Advisory).

1. Reconnaissance: Identify a target running OpenC3 COSMOS open-source edition prior to version 7.0.0 with access to the Command Sender UI.
2. Authentication: Log in with a low-privileged authenticated account, or craft a phishing scenario to influence the victim's input in the Command Sender UI.
3. Select vulnerable command: Using the Command Sender drop-down form, choose any command that supports ARRAY parameters (e.g., INST ARYCMD).
4. Inject payload: Inside the square brackets […] of the array parameter field, insert a JavaScript payload, for example: alert("XSS").
5. Trigger execution: Click the "Send" button to submit the command to CmdTlmServer.
6. Observe execution: The injected JavaScript executes in the current browser session context, allowing the attacker to read session tokens from local storage or perform other actions within the authenticated session (GitHub Advisory).

• Logs: Unexpected JavaScript-like strings (e.g., alert(, document.cookie, localStorage) appearing in command parameter fields within COSMOS application logs or audit trails.
• Network: Outbound requests from the COSMOS web UI to unexpected external domains, potentially indicating data exfiltration of session tokens via XSS payloads.
• Browser/Session: Anomalous session activity from authenticated COSMOS users, such as session tokens being reused from unexpected IP addresses shortly after a command was sent.

The vulnerability is patched in OpenC3 COSMOS version 7.0.0; upgrading to this release is the recommended remediation (GitHub Advisory). For users unable to upgrade immediately, restrict access to the Command Sender UI to trusted users only and implement network controls to limit exposure. Additionally, deploying Content Security Policy (CSP) headers can reduce the impact of XSS vulnerabilities by restricting script execution sources.